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Abstract 

Belief change is a fundamental problem in AI: Agents constantly have to update 
their beliefs to accommodate new observations. In recent years, there has been 
much work on axiomatic characterizations of belief change. We claim that a better 
understanding of belief change can be gained from examining appropriate semantic 
models. In this paper we propose a general framework in which to model belief 
change. We begin by defining belief in terms of knowledge and plausibility: an agent 
believes (j) if knows that (j) is more plausible than -i</>. We then consider some 
properties defining the interaction between knowledge and plausibility, and show 
how these properties affect the properties of belief. In particular, we show that 
by assuming two of the most natural properties, belief becomes a KD45 operator. 
Finally, we add time to the picture. This gives us a framework in which we can 
talk about knowledge, plausibility (and hence belief), and time, which extends the 
framework of Halpern and Fagin for modeling knowledge in multi-agent systems. 
We then examine the problem of "minimal change" . This notion can be captured by 
using prior plausibilities, an analogue to prior probabilities, which can be updated 
by "conditioning" . We show by example that conditioning on a plausibility measure 
can capture many scenarios of interest. In a companion paper, we show how the two 
best-studied scenarios of belief change, belief revision and belief update, fit into our 
framework. 
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1 Introduction 



In order to act in the world we must make assumptions, such as "the corridor is clear" or 
"my car is parked where I left it" . These assumptions, however, are defeasible. We can easily 
imagine situations where the corridor is blocked, or where the car is stolen. We call the 
logical consequences of such defeasible assumptions beliefs. As time passes, we constantly 
obtain new information that might cause us to make additional assumptions or withdraw 
some of our previous assumptions. The problem of belief change is to understand how beliefs 
should change. 

The study of belief change has been an active area in philosophy and in artificial intelli- 
gence [Gar88,KM91a]. In the literature, two instances of this general phenomenon have been 
studied in detail: Belief revision [AGM85,Gar88] attempts to describe how an agent should 
accommodate a new belief (possibly inconsistent with his other beliefs) about a static world. 
Belief update [KM91a], on the other hand, attempts to describe how an agent should change 
his beliefs as a result of learning about a change in the world. Belief revision and belief update 
describe only two of the many ways in which beliefs can change. Our goal is to construct a 
framework to reason about behef change in general. This paper describes the details of that 
framework. In a companion paper [FH97a] we consider the special cases of belief revision 
and update in more detail. 

Perhaps the most straightforward approach to belief change is to simply represent an agent's 
beliefs as a closed set of formulas in some language and then put constraints on how these 
beliefs can change. This is essentially the approach taken in [AGM85,Gar88,KM91a]; as their 
results show, much can be done with this framework. The main problem with this approach 
is that it does not provide a good semantics for belief. As we hope to show in this paper 
and in [FH97a], such a semantics can give us a much deeper understanding of how and why 
beliefs change. Moreover, this semantics provides the tools to deal with comphcating factors 
such actions, external events, and multiple agents. 

One standard approach to giving semantics to beliefs is to put a preference ordering on 
the set of worlds that the agent considers possible. Intuitively, such an ordering captures 
the relative likehhood of worlds. Various authors [Bou92,GP92,KM91a,Spo88] have then 
interpreted "the agent believes 0" as "0 is true in the most plausible worlds that the agent 
considers possible". An alternative approach is to put a probability measure over the set 
of possible worlds. Then we can interpret "the agent believes 0" as "the probability of is 
close to 1" [Pea89] . We examine a new approach to modeling uncertainty based on plausibility 
measures, introduced in [FH95,FH97b], where a plausibility measure just associates with an 
event (i.e., a set of possible worlds) its plausibility, an element in some partially ordered set. 
This approach is easily seen to generalize other approaches to modeling uncertainty, such 



in Proceedings of the 5th Conference on Theoretical Aspects of Reasoning About Knowledge, 1994, 
pp. 44-64, under the title "A knowledge-based framework for belief change. Part I: Foundations" . 
This version is almost identical to one that will appear in Artificial Intelligence. 
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as probability measures, belief functions, and preference orderings. We interpret the "agent 
believes 0" as "the plausibility of is greater than that of -|0". As we show, this is often 
(but not always) equivalent to "0 is true in the most plausible worlds" . 

By modeling beliefs in this way, there is an assumption that the plausibility measure is part of 
the agent's epistcmic state. (This assumption is actually made explicitly in [Bou92,KLM90].) 
This implies that the plausibility measure is subjective, that is, it describes the agent's 
estimate of the plausibility of each event. But actually, an even stronger assumption is 
being made: namely, that the agent's epistemic state is characterized by a single plausibility 
measure. We feel that this latter assumption makes the models less expressive than they 
ought to be. In particular, they cannot represent a situation where the agent is not sure 
about what is plausible, such as "Alice does not know that it typically does not rain in 
San Francisco in the summer". To capture this, we need to allow Alice to consider several 
plausibility measures possible; in some it typically does not rain and in others it typically 
does. ^ As we shall see, this extra expressive power is necessary to capture some interesting 
scenarios of behef change. 

To deal with this, in addition to plausibility measures, we add a standard accessibility relation 
to represent knowledge. Once we have knowledge in the picture, we define belief by saying 
that an agent believes (f) if she knows that is typically true. That is, according to all the 
plausibility measures she considers possible, is more plausible than -i0. 

The properties of belief depend on how the plausibihty measure interacts with the acces- 
sibility relation that defines knowledge. We study these interactions, keeping in mind that 
plausibility generalizes probability. In view of this, it is perhaps not surprising that many 
of the issues studied by Fagin and Halpern [FH94a] when considering the interaction of 
knowledge and probability also arise in our framework. There are, however, a number of new 
issues that arise in our framework due to the interaction between knowledge and belief. As 
we shall see, if we take what are perhaps the most natural restrictions on this interaction, our 
notion of belief is characterized by the axioms of the modal logic KD45 (where an agent has 
complete introspective knowledge about her beliefs, but may have false beliefs). Moreover, 
the interaction between knowledge and belief satisfies the standard properties considered 
by Kraus and Lehmann [KL88]. Although our major goal is not an abstract study of the 
properties of knowledge and belief, we view the fact that we have a concrete interpretation 
under which these properties can be studied to be an important side-benefit of our approach. 

Having a notion of belief is not enough in order to study belief change. We want a framework 
that captures the beliefs of the agent before and after the change. This is achieved by 
introducing time explicitly into the framework. The resulting framework is an extension of 

the framework of Halpern and Fagin [HF89] for modeling knowledge in multi-agent systems, 
and allows to talk about knowledge, plausibility (and hence belief), and time. This framework 
is analogous to combination of knowledge, probability and time studied in [HT93]. As we 



^ In fact, this issue is discussed by Boutilier [Bou92], although his framework does not allow him 
to represent such a situation. 
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show by example, having knowledge, plausibility, and time represented explicitly gives us a 
powerful and expressive framework for capturing belief change. 

This framework is particularly suited to studying how plausibility changes over time. One 
important intuition we would like to capture is that of minimal change. Suppose an agent 
gets new information at time t. Certainly we would expect his plausibility assessment (and 
his beliefs) at time t + 1 to incorporate this new information; otherwise, we would expect his 
assessment at time t + 1 to have changed minimally from his assessment at time t. In prob- 
abilistic reasoning, it can be argued that conditioning captures this intuition. Conditioning 
incorporates the new information by giving it probability 1. Moreover, the relative probability 
of all events consistent with the new information is the same before and after conditioning, 
so, in this sense, conditioning changes things minimally. We focus here on a plausibilistic 
analogue of conditioning and argue that it captures the intuition of minimal change in plau- 
sibilities. We can then proceed much in the spirit of the Bayesian approach, but starting with 
a prior plausibility and conditioning. As we show, many situations previously studied in the 
literature, such as diagnostic reasoning [Rei87], can be easily captured by using such prior 
plausibilities. Moreover, as we show in a companion paper [FH97a], belief revision and belief 
update — which both attempt to capture intuitions involving minimal change in beliefs — can 
be captured in our framework by conditioning on an appropriate prior plausibility measure. 
Thinking in terms of priors also gives us insight into other representations of belief change, 
such as those of [Bou94b,GP92,LS94]. 

The rest of this paper is organized as follows. In the next section, we review the syntax and 
semantics of the standard approach to modeling knowledge using Kripke structures and show 
how plausibility can be added to the framework. Much of our technical discussion of axiom- 
atizations and decision procedures is closely related to that of [FH94a]. In Section 3.1, we 
present our full framework which adds plausibility to the framework of [HF89] for modeling 
knowledge (and time) in multi-agent systems. In Section 4 we introduce prior plausibilities 
and show how they can be used. We conclude in Section 5 with some discussion of the general 
approach. Proofs of theorems are given in Appendix A. 



2 Knowledge and Plausibility 



In this section, we briefly review the standard models for knowledge and beliefs (see [HM92] 
for further motivation and details), describe a notion of plausibility, and then show how to 
combine the two notions. Finally, we compare the derived notion of belief with previous work 
on the subject. 
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2.1 The Logic of Knowledge 



We start by examining the standard models for knowledge and belief. The syntax for the logic 
of knowledge is simple: we start with primitive propositions and close off under conjunction, 

negation, and the modal operators Ki, . . . , Kn- A formula such as Kicj) is read "agent i knows 
0". The logic of belief is the result of replacing the Ki operator by Bi. The formula, Bicj) is 
read "agent i believes 0". The resulting languages are denoted and respectively. 

The semantics for these languages is given by means of Kripke structures. A Kripke structure 
for knowledge (or belief) is a tuple {W, vr, JCi, . . . , /C„), where 1^ is a set of possible worlds, 
7i{w) is a truth assignment to the primitive propositions at world w G W, and the /Cj's are 
accessibility relations on the worlds in W. For convenience, we define ICi{w) = {w' : {w, w') e 
/Cj}. Intuitively, lCi{w) describes the set of worlds that agent i considers possible in w. We 
say that agent i knows (or believes) at world if all the worlds )Ci{w) satisfy (f). 

We assign truth values to formulas at each world in the structure. We write (M, w) |= if 
the formula (f) is true at a world w in the Kripke structure M. 

• (M, w) \^ p for a primitive proposition p if 7r{w){p) — true, 

• (M, w) h ^(f) if (M, w) ^ 0, 

• (M, ^ A V' if {M, w) h and (M, w) |= ijj, 

• (M, w) h Ki(f) if (M, w') h for all w' E lCi{w). 

The last clause captures the intuition that (f) is known exactly when it is true in all possible 
worlds. When considering the language of beliefs , we typically use rather than /Cj to 
denote the accessibility relations. The truth condition for Bicf) is exactly the same as for Kicf). 

Let M.K be the class of Kripke structures described above. We say that e is valid 
in some M e Mr if {M, w) |= for all w in M. We say that e is valid in Mr if 
it is valid in all models M e M.r. We say that is satisfiable in Mr if there is a model 
M e Mr and world w such that (M, |= 0. 

The definition of Kripke structure does not put any restriction on the /Cj relations. By 
imposing conditions on the /Cj relations we get additional properties of knowledge (or belief). 
These properties are captured by systems of axioms that describe the valid formulas in classes 
of structures that satisfy various constraints of interest. We briefly describe these systems and 
the corresponding constraints on the accessibility relations. Consider the following axioms 
and rules: 

KI. All substitution instances of propositional tautologies 
K2. K4 A Ki{(t) =^ V) =^ Kii^ 
K3. K4 
K4. Kicj) =^ KiKicf) 
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K5. ^Ki^ Ki^Kicf) 
K6. -iKifalse 

RKl. Prom and (f) ip infer ip 
RK2. Prom infer 

The system K contains the axioms Kl and K2 and the rules of inference RKl and RK2. By 
adding axioms K4 and K5 we get system K45; if in addition we add axiom K6 we get system 
KD45; if instead we add axiom K3 to K45 we get the axiom system known as S5. 

We now relate these axiom systems with restrictions on the accessibility relations. We start 
with some definitions. A relation 7?. on 1^ is Euclidean if {x,y), {x, z) e TZ implies that 
(y, z) e TZ, for all x, y and z in W; it is reflexive if {x, x) & TZ for all x G W; it is serial if for 
all a; e there is ay such that {x, y) G R; and it is transitive if {x, y), {y, z) &TZ implies that 
{x, z) G TZ, for X, y and z in W. Let be the set of Kripke structures with Euclidean and 
transitive accessibility relations, 7W|^* be the subset of where the accessibility relations 
are also serial, and M.^^ be the subset of M.^ where the accessibility relations are also 
transitive. 

Theorem 1 [HM92] The axiom system K (resp. K45, KD^S, S5) is a sound and complete 
axiomatization of with respect to A4k (resp. M!^^, M!^^ , A4k^). 

In this paper, we use the multi-agent systems formalism of [PHMV95] to model knowledge; 
this means that knowledge satisfies the axioms of S5. (We provide some motivation for this 
choice below; see [FHMV95] for further discussion.) 

This implies that if an agent knows 0, then is true (K3) and that the agent is introspective — 
he knows what he knows and does not know (K4 and K5). Belief, on the other hand, is 
typically viewed as defeasible. Thus, it docs not necessarily satisfy K3. It may satisfy a weaker 
property, such as K6, which says that the agent does not believe inconsistent formulas. Like 
knowledge, behef is taken to be introspective, as it satisfies K4 and K5. Thus, in the literature, 
belief has typically been take to satisfy K45 or KD45; we do the same here. According to 
Theorem 1, this means that the notion of knowledge we use is characterized by A^|J* while 
belief is characterized by or ^ 

2.2 Plausibility Measures 

Most non-probabilistic approaches to belief change require (explicitly or implicitly) that 
the agent has some ordering over possible alternatives. Por example, the agent might have a 
preference ordering over possible worlds [Bou94b,Gro88,KM91b] or an entrenchment ordering 

^ As is well known, a relation is reflexive, Euclidean and transitive if and only if it is an equivalence 
relation (i.e., reflexive, symmetric and transitive). Thus, 7W|^* consists of these structures where 
the /Cj's are equivalence relations. 
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over formulas [GM88]. This ordering dictates how the agent's behefs change. For example, in 
[Gro88], the new beliefs are characterized by the most preferred worlds that are consistent 
with the new observation, while in [GM88] beliefs are discarded according to their degree of 
entrenchment until it is consistent to add the new observation to the resulting set of beliefs. 

Keeping this insight in mind, we now describe plausibility measures [FH95,FH97b]. This is 
a notion for handling uncertainty that generalizes previous approaches, including various 
notions of preference ordering. We briefly review the relevant definitions and results here. 

Recall that a probability space is a tuple {W, J-,Pt), where is a set of worlds, J- is 
an algebra of measurable subsets of W (that is, a set of subsets closed under imion and 
complementation to which we assign probability), and Pr is a probability measure, that is, a 
function mapping each set in to a number in [0, 1] satisfying the well-known probability 
axioms (Pr(0) = 0, Pt{W) = 1, and Pr(^ U S) = Pr(^) + Pr(S), if A and B are disjoint). 

A plausibility space is a direct generalization of a probability space. We simply replace the 
probability measure Pr by a plausibility measure PI, which, rather than mapping sets in T 
to numbers in [0, 1], maps them to elements in some arbitrary partially ordered set. We read 
Pl(yl) as "the plausibility of set A" . If P1(A) < Pl(-B), then B is at least as plausible as A. 
Formally, a plausibility space is a tuple S = (W^, JF, PI), where is a set of worlds, JF is 
an algebra of subsets of W, and PI maps sets in JF to some domain D of plausibility values 
partially ordered by a relation <d (so that <d is reflexive, transitive, and anti-symmetric). 
We assume that D is pointed: that is, it contains two special elements To and _Ld such that 
-Ld<d d <D for all d e D; we further assume that PI(T'^) = and PI(0) =-L_d. As 
usual, we define the ordering </? by taking di <d d2 if di <£, ^2 and di ^ d2- We omit the 
subscript D from <d, <d, Td and _Ld whenever it is clear from context. 

Since we want a set to be at least as plausible as any of its subsets, we require 

Al If A C B, then Fl{A) < Fl{B). 

Some brief remarks on this definition: We have deliberately suppressed the domain D of 
plausibility values from the tuple S, since for the purposes of this paper, only the ordering 
induced by < on the subsets in JF is relevant. The algebra JF also does not play a significant 
role in this paper. Unless we say otherwise, we assume JF contains all subsets of interest and 
suppress mention of J^, denoting a plausibility space as a pair {W, PI) . 

Clearly plausibility spaces generalize probability spaces. We now briefly discuss a few other 
notions of uncertainty that they generalize: 

• A belief function S on 1^ is a function B : 2^ [0, 1] satisfying certain axioms [Sha76]. 
These axioms certainly imply property Al, so a belief function is a plausibility measure. 

• A fuzzy measure (or a Sugeno measure) f on W [WK92] is a function / : 2^ i— >• [0, 1], 
that satisfies Al and some continuity constraints. A possibility measure [DP90] Poss is a 
fuzzy measure such that Poss(Vl^) = 1, Poss(0) = 0, and Poss(A) = sup^g^(Poss({w}). 

• An ordinal ranking (or K-ranking) on W (as defined by [GP92], based on ideas that go 
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back to [Spo88]) is a function k : 2^ ^ W*, where W* = W U {oo}, such that k{W) = 0, 
/s:(0) = oo, and k{A) = min^g^(/s;({w})). Intuitively, an ordinal ranking assigns a degree 
of surprise to each subset of worlds in W, where means unsurprising and higher numbers 
denote greater surprise. It is easy to see that if k is a ranking on W, then (VF, k) is a 
plausibility space, where x <]j\[* y if and only ii y < x under the usual ordering on the 
ordinals. 

• A preference ordering on 1^ is a partial order -< over W [KLM90,Sho87]. Intuitively, w -< w' 
holds if w is preferred to w'. Preference orders have been used to provide semantics for 
default (i.e., conditional) statements. In [FH97b] we show how to map preference orders 
on W to plausibility measures on ly in a way that preserves the ordering of events of the 
form {w} as well as the truth values of defaults. We review these results below. 

• A parametrized probability distribution (PPD) on is a sequence {Prj : i > 0} of 
probability measures over W. Such structures provide semantics for defaults in e-semantics 
[Pea89,GMP93]. In [FH97b] we show how to map PPDs into plausibility structures in a 
way that preserves the truth- values of conditionals (again, see discussion below). 

2.3 The Logic of Conditionals 

Our goal is to describe the agent's beliefs in terms of plausibility. To do this, we describe 
how to evaluate statements of the form 50 given a plausibility space. In fact, we examine 
a richer logical language that also allows us to describe how the agent compares different 
alternatives. This is the logic of conditionals. Conditionals are statements of the form — > ■0, 
read "given 0, ip is plausible" or "given 0, then by default V""- The syntax of the logic of 
conditionals is simple: we start with primitive propositions and close off under conjunction, 
negation and the modal operator — The resulting language is denoted . 

Many semantics have been proposed in the literature for conditionals. Most of them involve 
structures of the form (W^, X, vr), where is a set of possible worlds, 7r(w) is a truth as- 
signment to primitive propositions, and X is some "measure" on W such as a preference 
ordering, a re-ranking, or a possibility measure. We now describe some of the proposals in 
the literature, and then show how they can be viewed as using plausibility measures. Given 
a structure (W, X, tt), let |0] QW he the set of worlds satisfying 0. 

• A possibility structure is a tuple (M/, Poss, tt), where Poss is a possibility measure on W. 
It satisfies a conditional — > if either Poss([0]) = or Poss([0 A -0]) > Poss([0 A -^ip\) 
[DP91]. That is, either is impossible, in which case the conditional holds vacuously, or 
A -0 is more possible than A ^ip. 

• A K-structure is a tuple (IV,K,7r), where k is an ordinal ranking on W. It satisfies a 
conditional ^ if either /t(|0]) = oo or fi;(|0 A V]) < /t([0 A ^^]) [GP92]. 

• A preferential structure is a tuple (VF, tt), where -< is a partial order on W . The intuition 
[Sho87] is that a preferential structure satisfies a conditional ^ ^ if all the most preferred 
worlds (i.e., the minimal worlds according to -<) in |0] satisfy ^0. However, there may be 
no minimal worlds in |0] . This can happen if |0] contains an infinite descending sequence 
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. . . -< W2 -< Wi. What do we do in these structures? There are a number of options: the first 
is to assume that, for each formula 0, there are minimal worlds in this is the assumption 
actually made in [KLM90], where it is called the smoothness assumption. A yet more 
general definition — one that works even if -< is not smooth — is given in [Lew73,Bou94a]. 
Roughly speaking, — > is true if, from a certain point on, whenever is true, so is ■0- 
More formally, 

(W, -<, vr) satisfies (f) ^ ip, if for every world Wi G there is a world W2 such that (a) 
1^2 di Wi (so that W2 is at least as normal as Wi), (b) W2 G |0 A^^], and (c) for all worlds 
1^3 -< W2, we have W3 G [0 =^ ip} (so any world more normal than W2 that satisfies 
also satisfies ip). 

It is easy to verify that this definition is equivalent to the earlier one if -< is smooth. 

• A PPD structure is a tuple (W, {Pr, : i > 0}, tt), where {Prj} is PPD over W. IntTiitively, 
it satisfies a conditional (f) ijj if the conditional probability given goes to 1 in the 
limit. Formally, ^ ^ is satisfied if limi^ooPri(MII^l) = 1 [GMP93] (where Pri(|^]||0]) 
is taken to be 1 if Pr^d^]) = 0). 

In [FH97b] we use plausibility to provide semantics for conditionals and show that our 
definition generalizes the definition in the various approaches we just described. We briefiy 
review the definitions and results here. 

A plausibility structure is a tuple PL — (VF,P1, tt), where PI is a plausibility measure on W. 
Conditionals are evaluated according to a rule that is essentially that used in possibility 
structures: 

• PL ^ ^ V if either Pl(|0l) =± or P1(|0 A -01) > P1([0 A --01)- 

Intuitively, 0^-0 holds vacuously if is impossible; otherwise, it holds if A -0 is more 
plausible than A -'ip. It is easy to see that this semantics for conditionals generalizes 
the semantics of conditionals in possibility structures and K-structures. The following result 
shows that it also generalizes the semantics of conditionals in preferential structures and 
PPD structures. 

Proposition 2 [FH97b] 

(a) If ~< is a preference ordering on W , then there is a plausibility measure Pl^ on W such 
that (VK ^, tt) ^ ^ ^ and only if {W, Pl^, vr) |= 0. 

(b) If PP = {Prj} is a PPD on W , then there is a plausibility measure Plpp such that 
{W, {Prj}, Tf) \= (p ^ ip if and only if {W, PW, tt) |= ^ -0. 

We briefiy describe the construction of Pl^ and Plpp here, since we use them in the sequel. 
Given a preference order -< on W, let Dq be the domain of plausibility values consisting of 
one element for every element w G W. We define a partial order on Dq using -<: d^ < d^ 
if w ^ V. (Recall that w < w' denotes that w is preferred to w' .) We then take D to be 
the smallest set containing Dq that is closed under least upper bounds (so that every set of 
elements in D has a least upper bound in D). For a subset A of W, we can then define Y'\^{A) 
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to be the least upper bound of {du, : w ^ A}. Since D is closed under least upper bounds, 
Pl^(A) is well defined. As shown in [FH97b], this choice of Pl^ satisfies Proposition 2. 

The construction in the case of PPD's is even more straightforward. Given a PPD PP — 
{Pri} on VF, we define Plpp as follows: 

Plpp(^) < Plpp{B) if and only if limi^^ Pri{B\A U B) = 1. 

A straightforward argument shows that this choice of Plpp satisfies Proposition 2. 

These results show that our semantics for conditionals in plausibility structures generalizes 
the various approaches examined in the literature. Does it capture our intuitions about 
conditionals? In the AI literature, there has been discussion of the right properties of default 
statements (which are essentially conditionals). While there has been little consensus on 
what the "right" properties for defaults should be, there has been some consensus on a 
reasonable "core" of inference rules for default reasoning. This core, known as the KLM 
properties [KLM90] , consists of the following axiom and rules of inference: 

LLE. Prom (f) ^ (f)' and — > '0 infer 0' — > '0 (left logical equivalence) 
RW. Prom ijj =^ ijj' and (f) ^ ijj infer — > ■0' (right weakening) 
REF. 0^0 (refiexivity) 

AND. Prom — > ■^i and ^ ^02 infer — > ■0i A ^02 
OR. Prom 0i — > ^0 and 02 — > '0 infer 0i V 02 — > '0 

CM. Prom ^ ■0i and — > ^02 infer A ■0i — > ^02 (cautious monotonicity) 

LLE states that the syntactic form of the antecedent is irrelevant. Thus, if 0i and 02 are 
equivalent, we can deduce 4>2 ^ ip from 0i — > t/). RW describes a similar property of the 
consequent: If '4> (logically) entails V'', then we can deduce — > V'' from — > ^0. This allows us 
to can combine default and logical reasoning. REP states that is always a default conclusion 
of 0. AND states that we can combine two default conclusions: If we can conclude by default 
both -01 and iIj2 from 0, we can also conclude ipi A -02 from 0. OR states that we are allowed 
to reason by cases: If the same default conclusion follows from each of two antecedents, then 
it also follows from their disjunction. CM states that if -01 and -02 are two default conclusions 
of 0, then discovering that ■0i holds when holds (as would be expected, given the default) 
should not cause us to retract the default conclusion -02. 

Do conditionals in plausibility structures satisfy the KLM properties? In general, the answer 
is no. It is almost immediate from the definition that a probability measure Pr is also a 
plausibility measure. Notice that Pr([0A'0]) > Pr(|0A->'0]) if and only if Pr(|-0] | [0]) > 1/2. 
Expanding the semantics of conditionals, we get that — -0 holds in Pr exactly if Pr(|0]) = 
or Pr(|'0] I [0]) > 1/2. It is easy to see that this definition does not satisfy the AND rule: 
it is not in general the case that — > -01 and (f> ^ ip2 together imply —>■ {ipi A since 
Pr{Ai I B) > 1/2 and Pt{A2 \ B) > 1/2 do not imply Pr(Ai n A2IS) > 1/2. Since the AND 
rule is a fundamental feature of qualitative reasoning, we would like to restrict to plausibility 
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structTircs where it holds. In [FH97b] we show that the following condition is necessary and 
sufficient to guarantee that the And rule holds: 

A2 If A, B, and C are pairwise disjoint sets, P\{AUB) > P1(C), and Pl(AuC) > P1(S), 
then Pl{A) > Pl(SUC). 

It turns out that conditionals in plausibility structures that satisfy A2 also satisfy LLE, 
RW, and CM. They also satisfy OR when one of the conditionals 0i — > V ^^^^ 02 — "0 is 
satisfied non- vacuously (that is, in a plausibihty measure PI such that either Pl(|0i]) > ± 
or Pl(|02l) > -L). To satisfy OR in general we need another condition: 

A3 If F\{A) = F\{B) =±, then F\{A U B) =L. 

A3 also has a nice axiomatic characterization. Let N(f) be an abbreviation for -i0 false. 
(This operator is called the "outer modality" in [Lew73].) Expanding the definition of — 
we get that iV0 holds at w if and only if Pl(|-i0]) =_L. Thus, N(}) holds if -i0 is considered 
completely implausible. We can think of the N modality as the plausibihstic version of 
necessity. It is easy to show that A3 corresponds to an AND rule for N. It holds exactly if 
{N(l)ANiP) =^ N{(j)Aip). 

A plausibility space {W, PI) is qualitative if it satisfies A2 and A3. A plausibility structure 
{W, PI, tt) is qualitative if {W, PI) is a qualitative plausibihty space. In [FH97b] we show that, 
in a very general sense, qualitative plausibility structures capture default reasoning. More 
precisely, we show that the KLM properties are sound with respect to a class of plausibility 
structures if and only if the class consists of qualitative plausibility structures. We also show 
that a very weak condition is necessary and sufficient in order for the KLM properties to be 
complete axiomatization of the language of default entailment considered in [KLM90] . These 
results help explain why so many different approaches to giving semantics to conditionals 
are characterized by the KLM properties. In addition, as we shall see, it also shows that if 
we want belief to have some reasonable properties, then we need to restrict to qualitative 
plausibility measures. 

2.4 Combining Knowledge and Plausibility 

We now define a logic that combines knowledge and plausibility. Let C^^ be the language 
obtained by starting with primitive propositions, and closing off under conjunction, negation, 
and the operators and — *j , i = 1, . . . ,n. Note that we have a different conditional operator 
for each agent. We read (p — >i ip as "according to agent i's plausibility measure, typically 
implies . 

A (Kripke) structure (for knowledge and plausibility) is a tuple {W, tt, /Ci, . . . , /C^, Vi, . . . , Vn) 
where W, tt and /Cj are just as in Kripke structures for knowledge, while Vi is a plausibility 
assignment, a function that assigns a plausibility space to agent i at each world. Intuitively, 
the structure Vi{w) — {W(^uj,i), P\w,i)) captures agent i's plausibility measure in the world w. 
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For now wc allow to be an arbitrary subset of W. We discuss some possible restrictions 

on W(^ui,i) below. It is reasonable to ask at this point where the plausibility spaces Vi{w) are 
coming from, and why we need a different one for each agent at each world. The answer to 
this question depends very much on the intended application. We defer further discussion of 
this issue until later. 

We can now give semantics to formulas in in Kripke structures for knowledge and 

plausibility. This is done in a recursive way using the rules specified above for and 
Statements of the form KiCp are evaluated according to fCf. 

• (M, w) h Ki(l) if (M, w') h for all w' e /Ci(w). 

Statements of the form cj) t/; are evaluated according to Vi- Let [0] = {w' G W(^u,^i) : 
(M,«;')h0}- 

• (M, w) \=(j)^i ijj if either Pl{w,i){M{y,i)) PW)(I^^^l(«',i)) > Pkw,i){l<p/\^^ljj{w,i))- 

We now define beliefs. Recall that true —>-i means that is more plausible than -i0 
according to agent's i plausibility measure. We might say that in this case the agent believes 
(f). However, recall that the agent can have different plausibility assessments at different 
worlds. Thus, there can be a model M, and worlds w, w' such that (w, w') G /Cj, but (M, w) 
true — >j while (M, w') \= -'{true -^i (f)). (In Example 5, we show why this extra expressive 
power is necessary.) That is, is more plausible than -i0 in one of the worlds the agent 
considers possible, but not in another. Since our intention is that the agent should not 
distinguish between accessible worlds, we would like the agent to have the same beliefs in all 
the worlds he considers possible. We say that an agent believes (p if he knows that (p is more 
plausible than -xf) in all the worlds he considers possible. Thus, we define read "agent 
i believes 0", as an abbreviation for Ki{true — >i 0). 

2.5 Example: Circuit Diagnosis 

The following example illustrates some of the expressive power of this language. Although 
it only involves one agent and only one plausibility measure in any given structure, it can 
easily be extended to allow for many agents with different plausibility measures. 

The circuit diagnosis problem has been well studied in the literature (see [DH88] for an 
overview). Consider a circuit that contains n logical components ci,...,c„ and k lines 
h, . . . ,lk- As a concrete example, consider the circuit of Figure 1.^ The diagnosis task is 
to identify which components are faulty. The agent can set the values of input lines of the 
circuit and observe the output values. The agent then compares the actual output values to 
the expected output values and attempts to locate faulty components. 

^ The "full adder" example is often used in the diagnosis literature. In our discussion here we 
loosely follow the examples of Reiter [Rei87] . 
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Fig. 1. A full adder. Xi and X2 are XOR gates, Ai and A2 are AND gates, and Oi is an OR gate. 

We model this situation using the tools we presented in the previous sections. We start by 
describing the agent's knowledge using a Kripke structure. We then construct two possi- 
ble plausibility measures over worlds in this Kripke structures, and examine the resulting 
knowledge and belief. 



Knowledge We model the agent's knowledge about the circuit using the Kripke struc- 
ture Mf^g = {Wdiag,T^diag,KLdiag)- Each possible world w e Wdiag IS composed of two parts: 
fault{w), the failure set — that is, the set of faulty components in w, and value{w), the value 
of all the lines in the circuit. We consider only worlds where the components that are not in 
the failure sets perform as expected. For example, in the circuit of Figure 1, if the AND gate 
Ai is not faulty, then we require that /s has value "high" if and only if both /i and I2 have 
the value "high". Most accounts of diagnosis assume that there is a logical theory A that 
describes the properties of the device. To capture our intuition, it must be the case that w 
is a possible world in M if and only ii fault{w) and value{w) are together consistent with A. 

The most straightforward language for reasoning about faults is the following: let ^diag = 
{faulty{ci) , . . . ,faulty{cn), hi{li), . . . , hi{lk)} be the set of propositions, where each faulty{c,i) 
denotes that component i is faulty and hi{li) denotes that line z in a "high" state. We then 
define the interpretation TTdiag in the obvious way: n diag{w){faulty{ci)) — true if Cj e fault{w), 
and 'Kdiag{'w){hi{li)) — true if (Zj, 1) e value{w). 

Next, we need to define the agent's knowledge. We define Oy, C value{w) to be the values of 
those hnes the agent sets or observes. The agent knows which tests he has performed and 
the results he observed. Therefore, we have {w, w') e K-diag if Oy, — 0^/. For example, suppose 
the agent observes hi{li) Ahi{l2) A hill^) A hi{l-j) A hi{l^). The agent then considers possible all 
worlds where the same observations hold. Since these observations are consistent with the 
correct behavior of the circuit, one of these worlds has an empty failure set. However, other 
worlds are possible. For example, it might be that the AND gate A2 is faulty. This would 
not affect the outputs in this case, since if Ai is non- faulty, then its output is "high" , and 
thus, Oi's output is "high" regardless of A2's output. 
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Now suppose that the agent observes hi{li) A -^hi{l2) A hi{l-i) A hi{l'j) A -ihi{ls). These observa- 
tions imply that the circuit is fauhy. (If li and are "high" and I2 is "low" , then the correct 
values for /y and /g should be "low" and "high", respectively.) In this case there are several 
possible failure sets, including {Xi}, {X2,0i}, and {X2, A2}. 

In general, there is more than one explanation for the observed faulty behavior. Thus, the 
agent can not know exactly which components are faulty, but he may have beliefs on that 
score. 



Plausibility To model the agent's beliefs, we need to decide on the plausibility measure 
the agent has at any world. We assume that only failure sets are relevant for determining 
a world's plausibility. Thus, we start by constructing a plausibility measure over possible 
failures of the circuit. We assume that failures of individual components are independent of 
one another. If we also assume that the likelihood of each component failing is the same, we 
can construct a preference ordering on failure set as follows: If /i and /2 are two failure sets, 
we say that /i is preferred to /2 if |/i| < I/2I, that is, if /i consists of fewer faulty components 
than /2. This preference ordering induces a plausibility measure using the construction of 
Proposition 2. In this measure Pl(-Fi) < Pl(-p2) if i^i^i/eFid/l) < iiiiii/GF2(l/l)- 

We can construct the same plausibility measure based on probabilistic arguments using 
PPDs. Suppose that the probability of a single component failing is e. Since we have assumed 
that failures are independent, it follows that the probability of a failure set / is e'^' (1— e)'^"~l-^l\ 
since there are |/| components that fail, and n—\f\ components that do not fail. To model the 
behavior of small but unknown failure probability, we can consider the PPD (Pro, Pri, . . .), 
where in Pr^ the probability of a single failure is l/(m + 1). It is not hard to check that 
lim„j^oo Prm(-F2)/ Prm(-^i) = if and only if Pl(-F2) < Pl(-Fi) in the plausibility measure 
described above. Interestingly, this plausibility measure is almost identical to the ^-ranking 
in which «({/}) = |/|. The only difference is that if |/i| = I/2I, Pl({/i}) is incomparable to 
Pl({/2}) ill plausibility measure we constructed, while they are equal according to the 
K-ranking. 

In some situations it might be unreasonable to assume that all components have equal failure 
probability. Thus, we might assume that for each component q there is a probability of 
failure. If we assume independence, then given e = (ei, . . . ,e„), the probability of a failure 
set / is Ilcjg/ej nc-^/(l — Cj). We can construct a PPD that captures the effect of the e^'s 
getting smaller, but at possibly different rates: Suppose 51 is a bijection from W" to ]N. 
If m = (mi, . . . ,m„), let Prg(,7i) be the distribution where the probability of q failing is 
l/(mj + 1), for i = 1, . . . , n. In this case, we get that lim^^^oo Prm(/2)/ Prm(/i) = if and 
only if /2 is a strict subset of /i, i.e., if /i contains all the components in /2 and more. Since 
we do not assume any relations among the failure probabilities of different components, it 
is not possible to compare failure sets unless one is a subset of the other. Thus, we can 
define / -< /' if / C /'. Using the construction of Proposition 2, we can again consider the 
plausibihty measure PI induced by ^. It is not hard to see that Pl(-Fi) < Pl(-^2) if for every 
failure set /i G Fi — F2 there is some /2 G F2 such that /2 ^ /i- As our construction shows. 
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this plausibility measure can be induced by either a preference ordering or a PPD; however, 
it cannot be captured by a ^-ranking or a possibility measure, since the ordering on failure 
sets is partial. 



Beliefs We now have the required components to examine the agent's beliefs. Using the 
two plausibility measures we just described, we can construct two possible structures M^iag,! 
and Mdiag,2- In both structures we set W(^w,i) = ^diagiw), and in both Mj^iag^i and Mdiag,2 the 
plausibility measure is induced from a preference ordering on failures (using the construction 
of Proposition 2). In M^iag,!, we take the plausibility measure to be such that Pl(^,i)({w}) > 
^\w,i){{w'}) if and only if \fault{w)\ < \fault{w')\, and in Mdiag,2 so that Pl(^_i)({u'}) > 
Pl(«),i)({'"^'}) if s-nd only if fault{w) C fault{w'). It is easy to see that, in both structures, 
if there is a world w in which these observations occur and where fault{w) = 0, then the 
agent believes that the circuit is faultless. If the agent detects an error, he believes that 
it is caused by one of the minimal explanations of his observations, where the notion of 
minimality differs in the two structures. We now make this statement more precise. Let 
/ be a failure set. Let Df he the formula that denotes that / is the failure set, so that 
{M,w) 1= Df if and only if fault{w) = f. The agent believes that / is a possible diagnosis 
(i.e., an explanation of his observations) if -iBi-iDf. The set of diagnoses the agent considers 
possible is Bel(M, w) = {/ : {M,w) |= ^Bi^Df}. We say that a failure set / is consistent 
with an observation a if it is possible to observe o when / occurs, i.e., if there is a world w 
in W such that fault{w) — f and Ou, — o.^ 

Proposition 3 (a) Bel{Mdiag,\)W) contains all failure sets f that are consistent with Ow 
such that there is no failure set f with \f'\ < \ f\ which is consistent with o^j. 

(h) Bel{Mdiag,2,w) contains all failure sets f that are consistent with such that there is 
no failure set f with f'df which is consistent with Ow 

PROOF. Straightforward; left to the reader. □ 

Thus, both Bel(Mtijag 1, w) and 'Be\{Mfiiag,2-, w) consist of minimal sets of failure sets consistent 
with Oyj, for different notions of minimality. In the case of M^iag,!, "minimality" means 
"of minimal cardinality", while in the case of Miiiag,2, it means "minimal in terms of set 
containment". This proposition shows that Mdiag,\ and Mdiag,2 capture standard assumptions 
made in model-based diagnosis; M^iag,! captures the assumptions made in [de 90], while 
Mdiag,2 captures the assumptions made in [Rei87]. More concretely, in our example, if the 
agent observes hi{I,i) A ^hi{l2) A hi{l^) A hi(lj) A -'hi{ls), then in M^iag,! she would believe that 
Xi is faulty, since {^i} is the only diagnosis with cardinality one. On the other hand, in 
Mdiag,2 she would beheve that one of the three minimal diagnoses occurred: {^i}, {^2, Oi} 
or {X2,A2}. 

^ Note that if A is a theory that describes the properties of circuit, then a failure / is consistent 
with observation o, if and only if / and are consistent according to A. 
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2. 6 Properties of Knowledge and Plausibility 

Kripke structures for knowledge and plausibility are quite similar to the Kripke structures for 
knowledge and probability introduced by Fagin and Halpern [FH94a]. The only difference 
is that in Kripke structures for knowledge and probability, Vi{w) is a probability space 
rather than a plausibility space. Fagin and Halpern explore various natural restrictions on 
the interactions between the probability spaces Vi{w) and the accessibility relations /Cj. 
Here we investigate restrictions on the interaction between the plausibility spaces and the 
accessibility relations. Not surprisingly, some of these conditions are exact analogues to 
conditions investigated by Fagin and Halpern. 

Given our interest in the KLM properties, we will be interested in structures that satisfy the 
following condition: 

QUAL Vi{w) is qualitative for all worlds w and agents i. 

The same arguments that show that A2 gives us the AND rule also show that it gives us 
property K2 for behefs. More precisely, we have the following result. 

Theorem 4 If M satisfies QUAL, then for all worlds w in M, we have 

(a) (M, w) 1= {{a 0) A (a V)) ^ ((^ (0 A V')) 

(b) (M, w) 1= A ^ 5,(0 A ^) 

(c) (M, w) 1= Bi<P A 5,(0 A V^) ^ Biip. 

PROOF. Straightforward; left to the reader. □ 

In view of this result, we typically assume that QUAL holds whenever we want to reason 
about belief. 

The set ^^(.^,^.4) consists of all worlds to which agent i assigns some degree of plausibility in 
world w. We would not expect the agent to place a positive probability on worlds that he 
considers impossible. Similarly, he would not want to consider as plausible (even remotely) 
a world he knows to be impossible. This intuition leads us to the following condition, called 
CONS for consistency (following [FH94a]): 

CONS W(^w^i) C K,i{w) for all worlds w and all agents i. ^ 

^ We remark that CONS is inappropriate if we use — > to model, not plausibility, but counterfactual 
conditions, as is done by Lewis [Lew 73]. If CONS holds, then it is easy to see that Kicj) =^ Ki{-^(j) — 
■0) is valid, for all ■0. That is, if agent i knows 0, then he knows that in the most plausible worlds 
where -i0 is true, ip is vacuously true, because there are no plausible worlds where -i0 is true. On 
the other hand, under the counterfactual reading, it makes perfect sense to say "I know the match 
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A consequence of assuming CONS is a stronger connection between knowledge and belief. 
Since CONS implies that the most plausible worlds are in ICi{w), it follows that if the agent 
knows 4> he also believes 4>. (Indeed, as we shall see, this condition characterizes CONS.) 

In probability theory, the agent assigns probability 1 to the set of all worlds. Since 1 > 0, this 

means the agent assigns non-zero probability to some sets of worlds. It is possible to have 
T = ± in plausibility spaces. If this happens, the agent considers all sets to be completely 
implausible. The following condition, called NORM for normality (following [Lew73]), says 
this does not happen: 

NORM V{w,i) is normal, that is, T(^(, j) >_L(^y j), for all worlds w and all agents i. 

We can strengthen this condition somewhat to one that says that the agent never considers 
the real world implausible. This suggests the following condition: Pl(TO^j) ({■«;}) >±. Stating 
this condition, however, leads to a technical problem. Recall that Pl(u,..j) is defined over the 
set of measurable subsets of In general, however, singletons may not be measurable. 

Thus, we examine a slightly weaker condition which we call REF for reflexive (following 
[Lew73]): 

REF For all worlds w and all agents i, 

• WE and 

• P\(^uj,i){A) >-L for all A e J-'(w,i) such that w E A. 

As we said in the introduction, much of the previous work using conditionals assumed (im- 
plicitly or explicitly) that the agent considers only one plausibility measure possible. This 
amounts to assuming that the plausibility measure is a function of the agent's epistemic 
state. This is captured by an assumption called SDP (following [FH94a]) for state deter- 
mined plausibilities: 

SDP For all worlds w and w' and all agents i, if {w, w') e /Cj then Vi{w) — Vi{w'). 

It is easy to see that SDP implies that an agent knows his plausibility measure. In particular, 
as we shall see, with SDP we have that — >i V implies Ki{(t) — V)- 

It is easy to verify that the structures described in the diagnosis example of Section 2.5 
satisfy CONS, REF, and SDP. As mentioned in the introduction, SDP is not appropriate in 
all situations; at times we may want to allow the agent to consider possible several plausibility 
measures. To capture this, we need to generalize SDP. The following example might help 
motivate the formal definition. 

Example 5 This is a variation of the Liar's Paradox. On a small Pacific island there are 

two tribes, the Rightfeet and the Leftfeet. The Rightfeet are known to usually tell the truth, 
while the Leftfeet are known to usually lie. Alice is a visitor to the island. She encounters a 
native, Bob, and discusses with him various aspects of life on the island. Now, Alice does not 

is dry, but it is not the case that if it were wet, then it would light if it were struck." 
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know to what tribe Bob belongs. Thus, she considers it possible both that Bob is a Rightfoot 
and that he is a Leftfoot. In the first case, she should believe what he tells her and in the 
second she should be skeptical. 

One possible way of capturing this situation is by partitioning the worlds Alice considers 
possible into two sets, according to Bob's tribe. Let Wr (resp. Wl) be the set of worlds 
that Alice considers possible where Bob is a Rightfoot (resp. Leftfoot). As the discussion 
above suggests, Alice's plausibility measure at the worlds of Wr gives greater plausibility 
to worlds where Boh is telling the truth than to worlds where Boh is lying; the opposite 
situation holds at worlds of Wl- In such a structure, the formula ->K Aiice~'{i'dl{4)) Alice 
-1(f)) A -iKAiice~'{tell{(j)) ^ Alice <P) is satisfiablc, where tell{(j)) is the formula that holds when 
Bob tells Alice (j). On the other hand, in structures satisfying SDP, this formula is satisfiablc 
only when tell{(})) has plausibility _L in all the worlds that Alice considers possible. 

While this example may seem contrived, in many situations it is possible to extract param- 
eters such as Leftfoot and Rightfoot that determine which conditional statements are true. 
For example, when we introduce time into the picture (in Section 3.1), these parameters 
might be the agent's own actions in the future. Such a partition allows us to make state- 
ments such as "I do not know whether is plausible or not, but I know that if I do a, then 
(f) is plausible", where (f) is some statement about the future. If the agent does not know the 
value of these parameters, she will not necessarily know which conditionals are true at a 
given world (as was the case in the example above). 

Example 5 motivates the condition called uniformity. 

UNIF For all worlds w and agents i, if w' e then Vi{w) = Vi{w'). ^ 

It is not hard to show that UNIF holds if and only if, for each agent i, we can partition 

the set of possible worlds in such a way that for each cell C in the partition, there is a 
plausibility space {Wc, Pic) such that Wc C C and Viiw) = (Wc, Pic) for ah worlds w E C. 
Moreover, if CONS also holds, then this partition refines the partition induced by the agent's 
knowledge, i.e., if C is a cell in the partition and w is some world C, then C C lCi{w). It 
easily follows that SDP and CONS together imply UNIF. 

When we model uncertainty about the relative plausibility of different worlds this way it 
is reasonable to demand that the plausibility measure totally orders all events; i.e., it is a 
ranking. The RANK assumption is: 

RANK For all worlds w and agents i, Vi{w) is a ranking, that is, for all sets A,B C 
either Pl^(/1) < PU(5) or PU(5) < PU(yl), and Pl^(/1 U B) = max(Pl^(/l), Pl^(5)). 

Note that K-rankings and possibility measures are two examples of rankings. Additionally, 
rational preference orderings of [KLM90] are essentially rankings in the sense that for each 

^ This condition is not the same as uniformity as defined in [Lew73] ; rather, it corresponds in the 
Lewis terminology to absoluteness. 
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rational preference ordering we can construct a ranking that satisfies exactly the same con- 
ditional statements [Fri97,FH97b]. 

While rankings are quite natural, they have often been rejected as being too inexpressive 
[Gin86]. In a ranking there is a total order on events. The standard argument for partial orders 
is as follows: In general, an agent may not be able to determine the relative plausibility of a 
and h. If the plausibility measure is a ranking, the agent is forced to make this determination; 
with a partial order, he is not. This argument loses much of its force in our framework, once 
we combine knowledge and plausibility. As we said above, the agent's ignorance can be 
modeled by allowing him to consider (at least) two rankings possible, one in which a is more 
plausible than 6, and one in which h is more plausible that a. The agent then believes neither 
that a is more plausible than h nor that h is more plausible than a. 



2. 7 Knowledge and Belief 

How reasonable is the notion of belief we have defined? In this section, we compare it to 
other notions considered in the literature. 

Recall that be the language where the only modal operators are Bi, . . . , Bn- Let C^^ be 
the language where we have i^i, . . . , Kn and Bi, . . . , Bn (but no — s>j operators). It is not hard 
to see (and will follow from our proofs below) that to get belief to satisfy even minimal such 
as K2, we need the AND rule to hold. Thus, in this section, we restrict attention to Kripke 
structures for knowledge and plausibihty that satisfy QUAL. We then want to investigate 
the impact of adding additional assumptions. Let Ai be the set of all Kripke structures for 
knowledge and plausibility that satisfy QUAL, and let M^'^^^ (resp. _A/fCC)NS,NORM^ 
structures satisfying QUAL and CONS (resp. QUAL, CONS and NORM). 

Work on belief and knowledge in the literature [HM92,Hin62,Lev84] has focused on the modal 
systems S5, KD45, K45, and K with semantics based on Kripke structures as described 
in Section 2.L Before we examine the properties of belief in our approach, we relate our 
semantics of belief (in terms of plausibility) to the more standard Kripke approach, which 
presumes that belief is defined in terms of a binary relation Bj. Can we define a relation Bi 
in terms of /C^ and Vi such that (M, w) |= Bicf) if and only if (M, v) \^ (f) for all v e Bi{w)7 
We show that this is possible in some structures, but not in general. 

Let S — {W, PI) be a qualitative plausibihty space. We say that A C 1^ is a set of most 
plausible worlds if P^{A) > Pl(^) (where A is the complement of A, i.e., W — A) and for 
all B (Z A, Pl(-B) / Pl{B). That is, A is a minimal set of worlds that is more plausible 
than its complement. It is easy to verify that if such a set exists, then it must be unique. 
To see this, suppose that A and A' are both sets of most plausible worlds. We now show 
that F\{A n A') > Fl{A n A'). Since A and A' are both most plausible sets of worlds, this 
will show that we must have A = A'. To see that Pl{A n A') > Pl(XiTA'), first note 
that An A', A — A' and A are pairwise disjoint. Since A and A' are most plausible sets 
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of worlds, we have that P\{{A n A') U {A - A')) = P\{A) > P1(A) and Pl{{A n A') UA)> 
F\{{A n A') U {A' - A)) = F\{A') > F\{W ) > F\{A - A'). We can apply A2 to get that 
Pl(/1 n A') > Fl{{A - A')UA) = Fl{AnA'). 

In finite plausibility structures (that is, ones with only finitely many worlds), it is easy to see 
that there is always a (unique) set of most plausible worlds. In general, however, a set of most 
plausible worlds does not necessarily exist. For example, consider the space 5*0 = (W^, PI), 
where W = {wi : i > 0} and PI is defined as follows: P1(A) = cxo if A contains an infinite 
number of worlds, and Fl{A) = maXu,^gA(0 otherwise. Suppose that F\{A) > F\{A). A must 
be finite, for otherwise P1(A) = oo. Thus, A must be infinite. Suppose Wi e A. It is easy 
to see that A — {wi} is infinite and A — {wi} is finite. Thus, Fl(A — {wi}) > Pl[A — {wi}). 
This shows that there does not exist a set of most plausible worlds in S. 

If there is no set of most plausible worlds, then we may not be able to find a relation Bi 
that characterizes agent i's beliefs. For example, consider the structure M = (WjH, ICi,Vi), 
where W = {wi : i > 0} is the set of worlds described in 5*0 above; tt assigns truth values 
to primitive propositions pi,P2, • • • in such a way that 7i{wi){pj) = true if and only if j > i; 
/Ci is the complete accessibility relation JCi = W x W; and Vi{wi) is the space 5*0 described 
above. It is not hard to verify that (M, wq) |= Bi(f) if and only if |~'0](«;o,i) is a finite set, 
i.e., there is an index i such that for all j > i, we have {M,Wj) \= (p. Thus, {M,wo) ^ BiPj 
for all J > 0. Yet there are no worlds in the model that satisfy all the propositions pj at 
once. Thus, there is no accessibility relation Bi that characterizes agent I's beliefs in wq. 

On the other hand, we can show that if there is always a set of most plausible worlds, then 
we can characterize the agents' beliefs by an accessibility relation. Let S = (W, PI) be a 
plausibility space. Define MP(S') to be the set of most plausible worlds in S if it exists, and 
if Fl{W) = ±. Otherwise MF{S) is not defined. 

Proposition 6 Let M be a Kripke structure for knowledge and plausibility. If MP{Vi{w')) 
is defined for all w' G Ki{w), then {M,w) ^ B^cf) if and only if {M,w") ^ (f) for all w" e 

PROOF. Straightforward; left to the reader. □ 



This proposition implies that, if most plausible sets of worlds always exist in M, then we can 
set Bi{w) = U^/gA:i(«))MP(Pj(w')) and recover the usual Kripke-style semantics for belief. 

This discussion shows that our model of belief is more general than the classical Kripke- 
structure account of beliefs, since there are models where the agent's beliefs are not de- 
termined by a set of accessible worlds. However, as we shall see, this does not lead to new 
properties of beliefs in C^. Roughly speaking, this is because we have a finite model property: 
a formula in is satisfiable if and only if it is satisfiable in a finite model (see Theorem 13 
below). It is easy to verify that in a finite model MP{Vi{w)) is always defined. We note. 
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however, that this finite model property is no longer true when we consider the interaction 
of beliefs with other modalities, such as time, or when we examine the first-order case. In 
these situations, the two models of beliefs are not equivalent. Plausibility is strictly more 
expressive; see [FHK96]. 

We now examine the formal properties of belief and knowledge in structures of knowledge 
and plausibility. We start by restricting our attention to . As we show below, the modal 
system K precisely characterizes the valid formulas of in the class }A. However, in the 
literature, belief has typically been taken to be characterized by the modal system K45 or 
KD45, not K. We get K45 by restricting to models that satisfy CONS, and KD45 by further 
restricting to models that satisfy NORM. Thus, the two requirements that are most natural, 
at least if we have a probabilistic intuition for plausibility, are already enough to make a 
KD45 operator. 

Theorem 7 K (resp., K^5, KD^S) is a sound and complete axiomatization for CP with 
respect to M (resp., M^ons^ _y^coNS,NORM^_ 



PROOF. See Appendix A.l. □ 



We now consider knowledge and belief together. This combination has been investigated in 
the literature [KL88,Voo92]. In particular, Kraus and Lehmann [KL88] define Kripke struc- 
tures for knowledge and belief that have two accessibility relations, one characterizing the 
worlds that are knowledge-accessible and one characterizing worlds that are belief-accessible. 
Ki and Bi arc defined, as usual, in terms of these relations. They argue that the two acces- 
sibility relations must be coherent in the sense that the agent knows what she believes and 
believes what she knows to be true. Kraus and Lehmann describe restrictions on the inter- 
action between the two relations that force this coherence. They show that in the resulting 
structures, the interactions between knowledge and belief are characterized by the following 
axioms. 

KBl. Bicf) ^ KiBicf) 
KB2. Ki(t) Bi(f) 

It turns out that KBl holds in Ai and KB2 is a consequence of CONS. To see this, recall 
that Bi(f) = Ki{true — > (p). Using positive introspection for knowledge (axiom K4), we derive 
that Bi(f) =^ KiKi{true — > 0). This is equivalent to axiom KBl. When M satisfies CONS, we 
have that W(^w,i) Q ^i{w). If {M,w) |= Kicj), then all worlds in K,i{w) satisfy 0. This imphes 
that there are no worlds satisfying -i0 in and thus B^cf) must hold. Thus, KB2 must 

hold. 

We now state this formally. Let AX^^ consist of the S5 axioms for the operators K^, the K 
axioms for the operators Bi, together with KBl; let AX^^''-'°'^^ consist of AX^^ together 
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with the K4 and K5 axioms for Bi and KB2; and let AX^^'^"^^-''"^^ consist of AX^^-^"''^ 
together with the K6 axiom for B^. 

Theorem 8 AJ<^^ (resp., ^^b,cons^ ^^b,cons,norm^ ^ ^^^^^ complete axioma- 
tization ofC^^ with respect to M (resp., M^ons^ _;v^cons,norm^ 



PROOF. See Appendix A. 1. □ 



As an immediate corollary, we get that there is a close relationship between our framework 
and that of [KL88]. Let KL be the logic of Kraus and Lehmann: 

Corollary 9 For any e C^^ , KL^(f)if and only i/ mCOns.norm ^ ^ 

We now relate to three other notions of beliefs in the literature — those of Moses and Shoham 
[MS93], Voorbraak [Voo92], and Lamarre and Shoham [LS94]. 

Moses and Shoham [MS93] also view belief as being derived from knowledge. The intuition 
that they try to capture is that once the agent makes a defeasible assumption, the rest of 
his beliefs should follow from his knowledge. In this sense, Moses and Shoham can be viewed 
as focusing on the implications of an assumption and not on how it was obtained. We can 
understand their notion as saying that is believed if it is known to be true in the most 
plausible worlds. But for them, plausibility is not defined by an ordering. Rather, it is defined 
in terms of a formula, which can be thought of as characterizing the most plausible worlds. 
More formally, for a fixed formula a, they define -Bf to be an abbreviation for Ki(a =^ 0). ^ 
The following result relates our notion of belief to that of Moses and Shoham. 

Lemma 10 Let M be a propositional Kripke structure of knowledge and plausibility satis- 
fying CONS and SDP. Suppose that w, i, and a are such that the most plausible worlds in 
Vi{w) are exactly those worlds in lCi{w) that satisfy a, i.e., MP(Vi{w)) = {w' G JCi{w) : 
{M,w') 1= a}. Then for any formula e JC^^ that includes only the modalities Ki and B^, 
{M,w) \= (f) if and only if {M,w) \= 0*, where (ff is the result of recursively replacing each 
subformula of the form B^ip in (j) by Ki{a -0*). 



PROOF. See Appendix A. 1. □ 



Voorbraak [Voo92] distinguishes two notions of knowledge: objective knowledge and true 
justified belief. He then studies the interaction of both notions of knowledge with beliefs. The 
intuition we assign to knowledge is similar to Voorbraak's intuition for objective knowledge. 

^ Shoham and Moses also examine two variants of this definition. These mainly deal with the 
cases where a is inconsistent with the agent's knowledge. For simplicity, we assume here that a is 
consistent with the agent's knowledge. 
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However, Voorbraak objects to the axiom Ki(l) =^ Bi(j), and suggests Bi(j) =^ BiKicj). The 
difference hes in the interpretation of behef. Voorbraak's notion of behef is stronger than 
ours. His view is that the agent cannot distinguish what he beiieves from what he knows 
(indeed, he believes that what he beheves is the same as what he knows). Our notion of 
belief is weaker, in that we allow agents to be aware of the defeasibihty of their beliefs. 

Lamarre and Shoham [LS94] investigate the notion of knowledge as justified true belief using 
a framework that is very similar to ours. They start with an explicit preference ordering 
over possible worlds, and then define W^cf) to read "given evidence a, holds in the most 
plausible ct-worlds" . Their formal account of B'^cj) is exactly a — >i in our notation. Unlike 
us, they examine a notion of knowledge as "belief stable under incorporation of correct 
facts", which is rather different then our notion of objective knowledge. Thus, while the 
technical construction is similar, the resulting framework is substantially different. Lamarre 
and Shoham take plausibility to be the only primitive, and use it to determine both knowledge 
and belief. We take both knowledge and plausibility to be primitive, and use them to define 
belief. 

2.8 Axiomatizing the Language of Knowledge and Plausibility 

Up to now, we have considered just the restricted language C^^. We now present sound 
and complete axiomatizations for the full language JC^'^. The technical details are much in 
the spirit of the axiomatizations presented in [FH94a] for knowledge and probability. Our 
complete axiomatization for Ai consists of two "modules": a complete axiomatization for 
knowledge (i.e., S5) and a complete axiomatization for conditionals. In the general case, 
there are no axioms connecting knowledge and plausibility. For each of the conditions we 
consider, we provide an axiom that characterizes it. The axioms characterizing NORM, REF, 
RANK, and UNIF are taken from [Lew73] and [BurSl] (see also [Fri97,FH97b]), while the 
axioms for CONS and SDP (and also UNIF) correspond directly to the axioms suggested 
in [FH94a] for their probabilistic counterparts. We also provide complete characterizations 
of the complexity of the validity problem for all the logics considered, based on complexity 
results for knowledge [HM92] and for conditionals [FH96a] . 

The axiom system can be modularized into three components: propositional reasoning, rea- 
soning about knowledge, and reasoning about conditionals. The component for propositional 
reasoning consists of Kl and RKl (from Section 2.1); the component for reasoning about 
knowledge consists of K2-K5 and RK2 (from Section 2.1); the component for reasoning 
about conditionals consists of the standard axioms and rules for conditional logic C1-C4, 
RCl, and RC2 described in [Fri97,FH97b] following [BurSl, Lew73]: 

CI. (f)^(f) 

C2. ((0 ^ Vi) A (0 ^ V2)) ^ (0 ^ {ipi A 1P2)) 

C3. ((01 ^ V') A (02 ^ ^)) ((01 V 02) ^ V) 

C4. ((01 ^ 02) A (01 ^ V')) ^ ((01 A 02) ^ V') 
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Rl. Prom (f) and (p infer 

RCl. Prom 44> 0' infer (0 ^ -0) ^ (</>' ^ -0) 

RC2. Prom ijj ^ ijj' infer (0 ^ -0) =^ (0 ^ "00 

Let AX consist of K1-K5, C1-C4, RKl, RK2, RCl, and RC2. 

Theorem 11 AX is a sound and complete axiomatization for C^'-^ with respect to Ai. 



PROOF. See Appendix A.2. □ 



We now capture the conditions described abov^CONS, NORM, REP, SDP, UNIP, and 
RANK — axiomatically. 

RANK, NORM, REP, and UNIP correspond the axioms C5-C8, respectively, from [Pri97,PH97b]: 

C5. ^ A ^(0 ^ -•O =^ A ^ ^ 
C6. {true ^ false) . 
C7. iV0^0 

C8. [(0 ^ip)^ N{(l) ilj)] A h(0 ^ip)^ N^{(l) ^)] 

CONS and SDP correspond to the following axioms, respectively; 

C9. Ki(l) Ni(f) 

CIO. (0 -^i iP) ^ Ki{<P -^i iP) 

It is interesting to note that the axioms for CONS and UNIP are derived from the axioms 
defined in [FH94a] by replacing w{(j)) = 1 (the probability of is 1) by Ni(j), which has 
a similar reading. We show that adding the appropriate axioms to AX gives a sound and 
complete axiomatization of the logic with respect to the class of structures satisfying the 
corresponding conditions. 

Theorem 12 Let A be a subset of {RANK, NORM, REF, UNIF, CONS, SDP} and let A 
be the corresponding subset of {C5, C6, CI, C8, C9, CIO}. Then AXU A is a sound and 
complete axiomatization with respect to the structures in M. satisfying A. 



PROOF. See Appendix A.2. □ 



We now consider the complexity of the validity problem. Our results are based on a combi- 
nation of results for complexity of epistemic logics [HM92] and conditional logics [PH96a]. 
Again, the technical details are much in the spirit of those in [PH94a]. 
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We start with few results that will be useful in our discussion of complexity. As is often the 
case in modal logics, we can prove a "small model property" for our logic: if a formula is 
satisfiable at all, it is satisfiable in a small model. Let Sub{4>) be the set of subformulas in 0. 
It is easy to see that an upper bound on \Sub{(p)\ is the number of symbols in (f). 

Theorem 13 Let A be a subset of {CONS, NORM, REF, SDP, UNIF, RANK}. The formula 
(f) is satisfiable in a Kripke structure satisfying A if and only if it is satisfiable in a Kripke 
structure with at most 21'^^^'' I worlds. 



PROOF. See Appendix A.2. □ 



This shows that if is satisfiable, then it is satisfiable in a model with at most exponential 
number of worlds. Such a "small model" result is useful when we consider upper bound on 
the complexity of checking satisfiable. Roughly speaking, if there is a small model, then we 
can construct this model in time, say, exponential in the size of the formula. However, there 
is one problem with the result we have just proved. This "small" number of worlds does not 
necessarily mean that we can compactly describe the Kripke structure. Recall that Pl(w,i) 
describes an ordering over subsets of Thus, in the worst case, we need to describe 

an ordering on 21^*'^'''^ I sets of worlds. Thus, the representation of a structure might be 
exponential in the number of worlds. Fortunately, we can show that a satisfiable formula is 
satisfiable in a small model with a compact representation. 

We start with a definition. We say that M = (W, vr, /Ci, . . . , /C„, Pi, ... , P„) is a preferential 
(Kripke) structure if for each Vi{w), there is a preference ordering -<{w,i) on W(_w,i) that 
induces Pl(«,,i) using the construction of Proposition 2. Recall that a preference ordering is a 
binary relation on the set of possible worlds. Thus, if W is finite, we can describe the relations 
/Cj and the preference orderings <{w,i) using tables of size at most \ Wf. So the representation 
of such structures is polynomial in \W\. Is it possible to find a small preferential Kripke 
structure satisfying 0? Indeed we can. Using results of [FH96a], we immediately get the 
following lemma: 

Lemma 14 Let A be a subset of {CONS, NORM, REF, SDP, UNIF, RANK}. If a formula 
(f) is satisfiable in a Kripke structure satisfying A with N worlds, then is satisfiable in a 
preferential Kripke structure with at most |Sub(0)|A^ worlds. 

Combining this with Theorem 13, we conclude that if is satisfiable, then it is satisfiable 
in a structure of exponential size with an exponential description. It can be shown that this 

result is essentially optimal (see [HM92,FH96a]). However, if there is only one agent and we 
assume CONS and either UNIF or SDP, then we can get polynomial-sized models. 

Theorem 15 Let A be a subset of {CONS, NORM, REF, SDP, UNIF, RANK} containing 
CONS and either SDP or UNIF. If talks about the knowledge and plausibility of only one 
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agent, then is satisfiable in a Kripke structure satisfying A if and only if it is satisfiable 
in a preferential Kripke structure satisfying A with at most |Sub(0)|^ worlds. 

PROOF. See Appendix A.2. □ 

We now consider the complexity of decision procedure for the vahdity problem. The difficulty 
of deciding whether 4> is valid is a function of the length of 4>, written \4>\. 

Theorem 16 Let A be a subset of {CONS, NORM, REF, SDP, UNIF, RANK}. If CONS e 

A, hut it is not the case that UNIF or SDP is in A, then the validity problem with respect 
to structures satisfying A is complete for exponential time. Otherwise, the validity problem 
is complete for polynomial space. 

PROOF. See Appendix A.2. □ 

If we restrict attention to the case of one agent and structures satisfying CONS and either 
UNIF or SDP, then we can do better. 

Theorem 17 Let A be a subset of {CONS, NORM, REF, SDP, UNIF, RANK} containing 
CONS and either UNIF or SDP. For the case of one agent, the validity problem in models 
satisfying A is co-NP- complete. 

PROOF. See Appendix A.2. □ 



3 Adding Time 

In the previous section, we developed a model of knowledge and beliefs. Having a good model 
of knowledge and belief is not enough in order to study how beliefs change. Indeed, if we are 
mainly interested in agents' beliefs, the additional structure of plausibility spaces does not 
play a significant role in a static setting. However, if we introduce an explicit notion of time, 
we expect the plausibility measure to (partially) determine how agents change their beliefs. 
As we shall see, this gives a reasonable notion of belief change. 

In this section, we introduce time into the framework. We then examine how time, knowledge, 
and plausibility interact. In particular, we suggest a notion of conditioning that captures the 
intuition that plausibility changes in the minimal way that is required by changes to the 
agent's knowledge. 
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3.1 Knowledge and Plausibility in Multi-Agent Systems 

A straightforward approach to adding time is by introducing another accessibihty relation 
on worlds, which characterizes their temporal relationship (see, for example, [KL88]). We 
introduce more structure into the description by adopting the framework of Halpern and 
Fagin [HF89] for modeling multi-agent systems. This structure gives a natural definition of 
knowledge and an intuitive way to describe agents' interactions with their environment. We 
start by describing the framework of Halpern and Fagin, and then add plausibility. 

The key assumption in this framework is that we can characterize the system by describing 
it in terms of a state that changes over time. This is a powerful and natural way to model 
systems. Formally, we assume that at each point in time, each agent is in some local state. 
Intuitively, this local state encodes the information that is available to the agent at that time. 
In addition, there is an environment^ whose state encodes relevant aspects of the system that 
are not part of the agents' local states. For example, if we are modeling a robot that navigates 
in some office building, we might encode the robot's sensor input as part of the robot's local 
state. If the robot is uncertain about his position, we would encode this position in the 
environment state. 

A global state is a tuple (sg, Si, . . . , s„) consisting of the environment state Sg and the local 
state Si of each agent i. A run of the system is a function from time (which, for ease of 
exposition, we assume ranges over the natural numbers) to global states. Thus, if r is a 
run, then r(0),r(l), ... is a sequence of global states that, roughly speaking, is a complete 
description of what happens over time in one possible execution of the system. We take a 
system to consist of a set of runs. Intuitively, these runs describe all the possible sequences 
of events that could occur in a system. 

Given a system TZ, we refer to a pair (r, m) consisting of a run r &TZ and a time m as a point. 
If r(m) = (sg, Si, . . . , s„), we define ri{m) = Si] thus, ri{m) is agent i's local state at the 
point (r, m). Finally, to reason in a logical language about such a system, we need to assign 
truth values to primitive propositions. An interpreted system is a tuple (7^, tt) consisting of a 
system TZ together with a mapping tt that associates a truth assignment with the primitive 
propositions at each state of the system. 

An interpreted plausibihty system can be viewed as a Kripke structure for knowledge. We 
say two points (r, m) and (r', m') are indistinguishable to agent i, and write (r, m) ~j (r', m'), 
if ri{m) ~ r^(m'), i.e., if the agent has the same local state at both points. This is consistent 
with the intuition that an agent's local state encodes all the information available to the 
agent. Taking ~j to define the ICi relation, we get a Kripke structure over points. ^ 

This definition of knowledge has proved useful in many applications in distributed systems 
and AI (see [FHMV95] and the references therein). As argued above, we want to add the 

^ It is straightforward to extend these definitions to deal with continuous time. This is done, for 
example, in [BLMS97]. 
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notion of plausibility so that we can model the agent's beliefs. It is straightforward to do 
so by adding a plausibility assessment for each agent at each point. Formally, an interpreted 
plausibility system is a tuple X = (7?,, tt, Pi, . . . , P„), where 71 and tt are as before, and 
the plausibility assignment Vi maps each point (r, m) to a plausibility space Vi{r,m) = 

In order to reason about the temporal aspects of the system, we add to the language temporal 
modalities in the standard fashion (see [GPSS80]). These include Q(j) for "0 is true at the 
next time step" We call this language C^^^ . Evaluation of temporal modahties at a point 
(r, m) is done by examining the future points on the run r: Given a point (r, m) in an 
interpreted system X, we have that 

• (X, r, m) \= Q)(j) if (X, r, m + 1) |= 0. ^ 

This framework is clearly a temporal extension of the logic of knowledge and plausibility 
described in the previous section. 

3.2 Example: Circuit Diagnosis Revisited 

We now show how the framework can be used to extend the example of Section 2.5 to 
incorporate time, allowing the agent to perform a sequence of tests. 

We want to model the process of diagnosis. That is, we want to model the agent's beliefs about 
the circuit while it performs a sequence of tests, and how the observations at each step affects 
her beliefs. Thus, we want to model the agent and the circuit as part of a system. To do so, we 
need to describe the agent's local state and the state of the environment. The construction 
we used in Section 2.5 provides a natural division between the two: The agent's state is 
the sequence of input-output relations observed, while the environment's state describes the 
faulty components of the circuit and the values of all the lines. This corresponds to our 
intuitions, since the agent can observe only the input-output relations. Each run describes 
the results of a specific series of tests the agent performs and the results he observes. We make 
two additional assumptions: (1) the agent does not forget what tests were performed and their 
results, and (2) the faults are persistent and do not change over time. Formally, wc define the 
agent's state ri(m) to be {o{r,o)-i ■ ■ ■ , 0(r,m))) where 0{r,m) describes the input-output relation 
observed at time m. We define the environment state re{m) — {fault{r, m), value{r, m)) to be 
the failure set at (r) and the values of all the lines. We capture the assumption that faults do 
not change by requiring that fault{r,m) = fault{r,0). The system TZdiag consists of all runs 
r satisfying these requirements in which value{r,m) is consistent with fault{r,m) and 0(r,m) 
for all m. 

Given the system TZdiag, we can define two interpreted plausibility systems corresponding 

^ It is easy to add other temporal modalities such as until, eventually, since, etc. These do not 
play a role in this work. 
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to the two plausibility measures we considered in Section 2.5. In both systems, W(^r,m,i) — 
/Cj(r, m). In Idiag,!-, we compare two points (ri,m) and (r2,m) by comparing the size of 
fault{ri,m) and fault{r-2,m), while in Tdiag,2 we check whether one failure set is a subset of 
the other. At a point (r, m) , the agent considers possible all the points where he performed 
the same tests up to time m and observed the same results. As before, the agent believes that 
the failure set is one of the minimal explanations of his observations. As the agent performs 
more tests, his knowledge increases and his beliefs might change. 

We define Bel(X, r, m) to be the set of failure sets (i.e., diagnoses) that the agent considers 
possible at (r, m). Belief change in Idiag,i is characterized by the following proposition. 

Proposition 18 // there is some f G Bel{Xdiag,i,r,m) that is consistent with the new ob- 
servation 0(r,m+i)7 then Bel{Xdiag,i, r, m + 1) consists of all the failure sets in Bel{Xdiag,i) r, m) 
that are consistent with 0(^r,m+i)- If all f e B{Xdiag,i,r,m) are inconsistent with 0(^r,m+i}, then 
B(Tdiag,i,r,m + l) consists of all failure sets of cardinality j that are consistent with 0(r,m+i), 
where j is the least cardinality for which there is at least one failure set consistent with 

0(r,m+l) ■ 



PROOF. Straightforward; left to the reader. □ 



Thus, in Idiag,!, a new observation consistent with the current set of most likely explana- 
tions reduces this set (to those consistent with the new observation). On the other hand, 
a surprising observation (one inconsistent with the current set of most likely explanations) 
has a rather drastic effect. It easily follows from Proposition 18 that if 0(r,m+i) is surpris- 
ing, then Bel{Idiag,i,r,m) fl Bel{Idiag,i,r,m + 1) — 0, so the agent discards all his current 
explanations in this case. Moreover, an easy induction on m shows that if Bel{Idiag,i, f^, fn) H 
Bcl(X£ijag.i, T, m + 1) = 0, then the cardinality of the failure sets in Bel{Xdiag,i,r,m + 1) is 
greater than the cardinality of failure sets in Bel{Idiag,i,''^,''TT')- Thus, in this case, the expla- 
nations in Bel{Idiag,i,'>^,'>TT' + 1) are more complicated than those in B{Xdiag,i-iT,m). Notice 
that if we can characterize the observation 0{r,m.+i) in our language — that is, if we have a 
formula such (X, r', m') |= if and only if 0{ri,m') — 0(r,m+i) — then we can also express the 
fact that agent i considers it surprising: This is true precisely if {Idiag,!,''^, ''tT') H Bi~'0(p- 

Belief change in Xdiag,2 is quite different, as the following proposition shows. Given a failure 
set /, we define ext{f) — {/' : / C /'}. Thus, ext{f) consists of all the failure sets that 
extend /. 

Proposition 19 Bel{Iiiiag,2-i'r-irn + 1) consists of the minimal (according to C) failure sets 
in ^f^Bel(i^- rm)^'^(-^) ^^^^ ^'^^ consistent with 0(r,m+i)- 

PROOF. Straightforward; left to the reader. □ 
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Wc sec that, as with 2diag,i, failure sets that are consistent with the new observation are 
retained. However, unlike Idiag,!-, failure sets that are discarded are replaced by more com- 
plicated failure sets even if some of the explanations considered most likely at (r, m) are 
consistent with the new observation. Moreover, while new failure sets in 'Be\(Xdiag,i, r, m + 1) 
can be unrelated to failure sets in Bel(Xdjag,i, "t.), in Idiag,2 the new failure sets must be 
extensions of some discarded failure sets. Thus, in Idiag,i the agent does not consider new 
failure sets as long as the observation is not surprising. On the other hand, in Idiag,2 the 
agent has to examine new candidates after each test. The latter behavior is essentially that 
described by Reiter [Rei87, Section 5]. 

3.3 Axiomatizing the Language of Knowledge, Plausibility and Time 

We now present sound and complete axiomatization for the language C^'-''^. The technical 
details are much in the spirit of the results of Section 2.8, with two exceptions. First, we 
need to deal also with the temporal modality Q. Second, instead of dealing with worlds, 
we are dealing with systems that have some structure, i.e., the distinction between agents' 
local state and the environment's state. As we shall see, both issues can be dealt with in a 
straightforward manner. 

The axiom system AX^ consists of the axioms and rule in the axiom system AX of Section 2.8 
and the following axioms and rule the describe the properties of 0-- 

Tl. 00 A 0(0^^) 
T2. 00 = -O-0 
RTl. From infer O0- 

Let C be the set of all plausibility interpreted systems. 

Theorem 20 The axiom system AX^ is a sound and complete axiomatization of C^'-'^^ with 
respect to C. 

PROOF. See Appendix A.3. □ 

We can also prove a result analogous to Theorem 12 that describes a complete axiomatization 
for the classes of systems satisfying some of the assumptions we examined in Section 2.4. 

Theorem 21 Let A be a subset of {RANK, NORM, REF, UNIF, CONS, SDP} and let A be 

the corresponding subset of {C5, C6, CI, C8, C9, CIO}. Then AX^ U A is a sound and 
complete axiomatization with respect to systems in C satisfying A. 

PROOF. See Appendix A.3. □ 
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4 Prior Plausibilities 



The formal framework of knowledge, plausibility and time described in the previous section 
raises a serious problem: While it is easy to see where the ~i relations that define knowledge 
come from, the same cannot be said for the plausibility spaces Vi{r, m). We now present one 
possible answer to this question, inspired by probability theory. 

Up to now, we have allowed the plausibility assessment at each point to be almost arbitrary. 
In particular, the plausibility space Vi{r,m) can be quite different from Vi{r,m + 1). Typ- 
ically, we would expect there to be some relationship between these successive plausibility 
assessments. For example, it seems reasonable to expect that the new plausibility assessment 
should incorporate whatever was learned at (r, m+l), but otherwise involve minimal changes 
from Vi{r, m). 

One way of doing this in probability theory is by conditioning. If we start with a probability 
function Pr and observe where Vi{E) > 0, then the conditional probability function Pr^ 
is defined so that PrE(A) = Pr(AnE)/ Pr(E). Typically Pte{A) is denoted Fr{A\E). Notice 
that Pte incorporates the new information E by giving it probability 1. It also is a minimal 
change from Pr in the sense that if A, B C E, then Pr(A)/Pr(S) = Fi{A\E) / Pr{B\E): the 
relative probability of events consistent with E is not changed by conditioning. ^° 

Conditioning is a standard technique in probability theory, and can be justified in a number 
of ways, one of which is the notion of "minimal change" we have just described. Another 
justification is a "Dutch book" argument [Fin72,Ram31], which shows that if an agent uses 
some other method of updating probabilities, then it is possible to construct a betting game 
in which he will always lose. Probability measures are particular instances of plausibility 
measures. Can we generalize the notion of conditioning to plausibility measures? 

It immediately follows from the definitions that the ordering of the likelihood of events 
induced by Pr^ is determined by the ordering induced by Pr: 

Pr{A\E) < Pr{B\E) if and only if Pr{A (1 E) < Pr(S n E). 

We want the analogous property for plausibility: 

COND P1(^|C) < P\{B\C) if and only if Pl(^ n C) < P\{B n C). 

This rule determines the order induced by posterior plausibilities. Since we are interested 
only in this aspect of plausibility, any method of conditioning that satisfies COND will do for 



^ There is another sense in which Pr^; represents the minimal change from Pr. If we measure the 
"distance" of a probability distribution Pr' from Pr in terms of the cross- entropy of Pr' relative 
to Pr, then it is well known that Pr^; is the distribution that minimizes the relative cross-entropy 
from Pr among all distributions Pr' such that Pt'{E) = 1 [KL51]. Indeed, this holds true for other 
distance measures as well [DZ82]. 
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our present purposes. (See [FH95] for an examination of other properties we might require of 
conditioning.) Notice that any two methods for conditioning are isomorphic in the following 
sense: Let Si = (Wi, Pli) and S2 = {W2, PI2) be two plausibility spaces. We say that and 
5*2 are (order) isomorphic if there is a bijection h from Wi to W2 such that, for A,B Q Wi, 
we have Pli(A) < Pli(S) if and only if Pl2(/i(A)) < P\2{h{B)). Any two definitions of 
conditioning that satisfy COND result in order-isomorphic plausibihty spaces (see [FH95] ) . 

This discussion suggests that we define P\(r,m.+i,i) to be the result of conditioning Pl(r,m,i) 
on the new knowledge gained by agent i at (r, m + 1). This, however, leads to the following 
technical problem. If the agent gains new knowledge at (r, m + 1), then ri{m) ^ ri{m + 1). 
This implies that the sets of points the agent considers possible are disjoint, i.e., /Cj(r, m) fl 
/Cj(r, m + 1) = 0. But then CONS implies that Pl(r,m,i) and Pl(r,m+i,j) a-re defined over disjoint 
spaces, so we cannot apply COND. 

We circumvent this difficulty by working at the level of runs. The approach we propose 
resembles the Bayesian approach to probabilities. Bayesians assume that agents start with 
priors on all possible events. If we were thinking probabilistically, we could imagine the agents 
in a multi-agent system starting with priors on the runs in the system. Since a run describes 
a complete history over time, this means that the agents are putting a prior probability 
on the sequences of events that could happen. We would then expect the agent to modify 
his prior by conditioning on whatever information he has learned. This is essentially the 
approach taken in [HT93] to defining how the agents' probability distribution changes in a 
multi-agent system. We can do the analogous thing with plausibility. 

We start by making the simplifying assumption that we are dealing with synchronous systems 
where agents have perfect recall [HV89]. Intuitively, this means that the agents know what the 
time is and do not forget the observations they have made. Formally, a system is synchronous 
if for any i, (r, m) ~i (r', m') only if m = m' . Notice that by restricting to synchronous 
systems, if we further assume that the plausibility measure Pi(r, m) satisfies CONS, we never 
have to compare the plausibilities of two different points on the same run. In synchronous 
systems, agent i has perfect recall if (r',m + 1) ~j (r, m + 1) implies {r',m) {r,m). Thus, 
agent i considers run r possible at the point (r, m + 1) only if he also considers it possible 
at (r, m) . This means that any runs considered impossible at (r, m) are also considered 
impossible at {r,m + 1); an agent does not forget what he knew. 

Just as with probability, we assume that an agent has a prior plausibility measure on runs, 
that describes his prior assessment on the possible executions of the system. As the agent 
gains knowledge, he updates his prior by conditioning. More precisely, at each point (r, m), 
the agent conditions his previous assessment on the set of runs considered possible at (r, m). 
This is process is shown in Figure 2. This results in an updated assessment (posterior) 
of the plausibility of runs. This posterior induces, via a projection from runs to points, a 
plausibility measure on points. We can think of agent i's posterior at time m as simply his 
prior conditioned on his knowledge at time m. 

To make this precise, let S — {W, PI) be a plausibility space. Define the projection of S on 
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Fig. 2. Schematic description of how the agent's knowledge evolves in time in synchronous systems 
with perfect recall. The boxes represent the set of points in ICi{r,m). Since the system is syn- 
chronous, at each time point, the agent consider possible points at the same time. Since the agent 
has perfect recall, as time progresses, the agent considers smaller and smaller sets of runs possible. 
The ovals represent two disjoint events that correspond to the same set of runs. 

E as S\e = {W\e:PI\e): where W\e = W n E and FI\e is the restriction of PI to W\e. 
Projection is similar to conditioning: for any definition of conditioning that satisfies COND 
if A,B C E, then Pl{A\E) < Pl{B\E) if and only if PI\e{A) < PI\e{B). Indeed, S\e is 
essentially isomorphic to any conditional plausibility measure that results from conditioning 
on E. " 



We can now define what it means for a plausibility measure on points to be generated by 
a prior. Suppose that agent i's prior plausibility at run r is V(r,i) = (J^{r,i),P\r,i)), where 
T^{r,i) ^ T^- Our intuition is that the agent conditions the prior by his knowledge at time 
{r,m). In our framework, the agent's knowledge at time ni is the set of point /C,j(r, m). We 
need to convert this set of points to an event in terms of runs. If A is a set of points, we 
define TZ{A) — {r : 3m((r, m) & A)} to be the set of runs on which the points in A lie. Using 
this notation, the set of runs agent i considers possible at (r, m) is simply 7^(/Cj(r, m)). Thus, 
after conditioning on this set of runs, we get agent i's posterior at {r,m), which is simply 
the projection of the prior on the observation: Pl{r,i)\-R{iCi{r,m))- We now use this plausibility 
measure, which is a measure on a set of runs, to define Vi{r,m), which is a measure on a 
set of points. We do so in the most straightforward way: we project each run to a point 
that lies on it. Formally, we say that Vi{r,m) is the time m projection of V(r^i)\-R,{Ki{r,m)) 



To make this precise, we need a notion that is slightly more general than isomorphism. Let 
P = (VF, Pr) be a probability space. A set A is called a support of P if Pr(yl) = 0. We can 
define a similar notion for plausibility spaces. Let S = {W, PI) be a plausibility space. We say that 
A C is a support of S, if for all B <Z W , V\{B) = V\{B n A). Thus, only B r\ A \s relevant 
for determining the plausibility of B. This certainly implies that Pl(^) = -L, since we must have 
P1(A) = P1(A n yl) = P1(0), but the converse does not hold in general. In probability spaces, 
Pr(A) = implies that Pr(B) = Pr(S fl A) for all S, but the analogous condition does not hold 
for arbitrary plausibility spaces. We say that two plausibility spaces S\ and <S'2 are essentially 
(order) isomorphic if there are supports Ci and C2 of Si and 6*2, respectively, such that 5*1 is 
isomorphic to 5*2 |c2- It is easy to see that, as expected, essential isomorphism defines an equivalence 
relation among plausibility spaces. Finally, it is easy to see that if S = (W,P1), then (PF,P1(-|£')) 
is essentially isomorphic to S'l^; when we use any conditioning method that satisfies COND. 
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Points 





Prior Evidence Posterior 

Fig. 3. Schematic description of the entities involved in the definition of priors. Note some are 
defined over runs and some over points. 

if Vi{r,m) = (W(^r,m,i),Pkr,m,i)), wheie W(r,m,i) = {(r',m) G ICi{r,m) : r' e TZi^r^i)} and for 
all A C W(r,m,i), we have that P\(^r,m,i){A) = P\r,i)\n{Ki{r,m)){'R-{A)). Pl(r,m,i) is the agent's 
plausibility measure at (r, m). This process is described in Figure 3. The main complications 
are due to the transition back and forth between entities defined over runs and ones defined 
over points. 

We remark that if the system satisfies perfect recall as well as synchrony, our original intuition 
that Vi{r,m + 1) should be the result of conditioning Vi{r, m) on the knowledge that agent 
i acquires at (r, m + 1) can be captured more directly. We can in fact construct Vi{r,m + 1) 
from Vi{r, m) by what can be viewed as conditioning on the agent's new information: We take 
Vi{r, m) and project it one time step forward by replacing each point (r', m) by (r', m+1). We 
then condition on /Cj(r, m+ 1) (i.e., the agent's knowledge at (r, m+ 1)) to get Vi{r, m, i + 1). 

Proposition 22 Let I be a synchronous system satisfying perfect recall such that P\(r,m,i) 
is the time m projection of a prior Pl(r,j) on runs for all runs r. times m, and agents i. 
Let prev{A) = {(r, m) : (r, m + 1) G A}. Then Pl(j.,m+i)(^) ^ Pi(r,m+i)(-S) if and only if 
P\(^r,m){P'>^Gv{A)) < Pl(^r,m){pf^Gv{B)) , for all ruus r, times m, and sets A,B& W^(r,m+i)- 



PROOF. Straightforward; left to the reader. □ 



We say that I — {TZ, tt, V) satisfies PRIOR if X is synchronous and for each run r and agent 
i there is a prior plausibility 7^(r,i) such that for all m, Vi{r,m) is the time m projection of 

Example 23 It is easy to verify that the two systems we consider in Section 3.2 satisfy 
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PRIOR. In both systems, the prior V(r,i) is independent of the run r, and is determined by 
the failure set in each run. 

By using prior plausibility measures, we have reduced the question of where the plausibility 
measure at each point comes from to the simpler question of where the prior comes from. 
While this question is far from trivial, it is analogous to a question that needs to be addressed 
by anyone using a Bayesian approach. Just as with probability theory, in many applications 
there is a natural prior (or class of priors) that we can use. 

By conditioning on plausibility rather than probability, we can deal with a standard problem 
in the Bayesian approach, that of conditioning on an event of measure 0: Notice that whenever 
a prior assigns an event a probability measure of it is not possible to condition on that 
event. The standard solution in the Bayesian school is to give every event of interest, no 
matter how unlikely, a small positive probability. We may well discover that a formula (f) 
that we believed to be true, i.e., one that was true in all the most plausible worlds, is in fact 
false. Under the probabilistic interpretation of plausibility, this means that we are essentially 
conditioning on an event {~<4>) of measure 0. The plausibility approach has no problem with 
this: the conditioning process described above still makes perfect sense. 

4-1 Conditioning as Minimal Change of Belief 

In this section we examine the properties of conditioning as an approach to minimal change 
of beliefs and relate our approach to others in the literature. 

Recall that QUAL guarantees that belief is closed under logical implication and conjunction 
(Theorem 4). In a synchronous system where the prior satisfies QUAL, it is not hard to see 
that conditioning preserves QUAL. Thus, we get the following result. 

Proposition 24 Let X be a synchronous system satisfying perfect recall and PRIOR. If the 
prior Pl(r,i) satisfies A 2 for all runs r and agents i, then axiom K2 is valid in X for B^. 

PROOF. Straightforward; left to the reader. □ 



This result shows that condition A2 is sufficient to get beliefs that satisfy K2. Is it also 
necessary? In general, the answer is no. However, A2 is the most natural condition that 
ensures that K2 is satisfied. To see this, note that if K2 is vahd in X then A2 holds for all 
pairwise disjoint subsets Ai, A2 and A3 of points in X definable in the language such that 
IZ{ICi{r,m)) = AiU A2U A^ for some run r, agent i, and time m. Thus, if we assume that 
the language is rich enough so that all subsets of X are definable (in that, for each subset A 

Of course, this requires that there be only countably many events of interest. 
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and agent i, there is a formula and point (r, m) such that A — |0](r,m,i))) then K2 forces 
A2. 

In view of this discussion, we focus in this section on synchronous systems with a quahtative 
prior. 

Next, we examine how changes in behefs are determined by the prior. Using Proposition 22, 
we now show that we can characterize, within our language, how the agent's beliefs change 
via conditioning, provided that we can describe in the language what knowledge the agent 
acquired. We say that a formula (f) characterizes agent i 's knowledge at (r, m + 1) with respect 
to his knowledge at (r, m) if, for all (r', m) G /Cj(r, m), we have (r', m+1) |= if and only if 
(r', m + 1) e Arj(r, m + 1). That is, among the points that succeed points that are considered 
possible at time m, exactly these satisfying are considered possible at time m + 1. Of 
course, it is not always possible to characterize the agent's new knowledge by a formula in 
our language. However, in many applications we can limit our attention to systems where 
it is possible. (This is the case, for example, in our treatment of revision and update in 
[Fri97,FH97a].) In such systems, we can characterize within the agent's belief change process 
in the language. 

Proposition 25 Let T he a synchronous system satisfying perfect recall and PRIOR. If (j) 
characterizes agent i's knowledge at {r,m + 1) with respect to his knowledge at {r,m), then 
(J, r,m + 1) \= ijj ^ if and only if (X, r, m) \= O(0 A ijj) -^i OC- 

PROOF. See Appendix A.4. □ 

Corollary 26 Let X he a synchronous system satisfying perfect recall and PRIOR. If (p 
characterizes agent i 's knowledge at {r,m + 1) with respect to his knowledge at (r, m), then 
{T, r, m + 1) 1= Biip if and only if (X, r, m) |= Ki{Q(j) =r- (O0 OV^))- Moreover, if I also 
satisfies SDP, then (X, r, m + 1) ^ Bill) if and only if (X, r, m) |= Q)(j) -^i Qip. 

We now use this result to relate our approach to other approaches for modeling conditionals 
in the hterature. Boutiher [Bou92] , Goldszmidt and Pearl [GP92] , and Lamarre and Shoham 
[LS94] give conditional statements similar semantics (using a preference ordering), but — > ^0 
is read "after learning 0, ip is believed" . Two crucial assumptions are made in these papers. 
The first is that the agent considers only one plausibility assessment, which in our terminology 
amounts to SDP. The second is that propositions are static, i.e., their truth value does not 
change along a run. Formally, a system is static if 7r(r(m)) = 7r(r(0)) for all runs r and 
times m. This implies that for any propositional formula (p, we have that (f) = O0- These 
two assumptions lead to a characterization of belief change. 

Corollary 27 Let I be a synchronous static system satisfying PRIOR, SDP, and perfect 
recall, and let and be propositional formulas. If characterizes agent i 's knowledge at 

This assumption is only implicit, since none of these papers have an explicit representation of 
time. Nevertheless, it is clear that this assumption is being made. 
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(r, m + 1) with respect to his knowledge at {r,m), then {I,r,m + 1) |= Bill) if and only if 

While this result shows that, in certain contexts, there is a connection between a statement 
such as "typically 0's are V^'s" (which is how we have between interpreting — >j ip) and "after 
learning 0, t/j is believed" (which is how it is interpreted in [Bou92,GP92,LS94]), the two 
readings are in general quite different. For one thing, notice that Corollary 27 assumes that 
and ip arc propositional formulas. This is a necessary assumption. If and ip contain modal 
formulas, then (p ^ ijj does not necessarily imply that the agent believes ip at the next time 
step. For example, if {I, r, m) |= B^xp, then for any formula 0, we have (X, r, m) |= — >j B{ip, 
regardless of whether Bi%p is believed at (r, m + 1). In [FH94b], we examine conditionals of 
the form (p > ip intended to capture the second interpretation "■?/' is believed after learning 
0". The semantics for these conditionals involves examining future time points, just as our 
intuitive reading dictates. As we have just seen, > and — > are quite different when we consider 
modal formulas in the scope of these conditionals. 

This discussion shows one of the benefits of representing time explicitly. In our framework 
we can distinguish between agents' plausibility assessment and their belief dynamics. Of 
course, we would like agents to be persistent in their assessment, which is exactly what 
conditioning captures. In the presence of several assumptions, we get a close connection 
between agents' conditional behefs and how their behefs change. This allows us to identify 
some of the assumptions implicitly made in previous approaches. For example, all of the 
approaches we mentioned above would not apply when we consider a changing environment, 
since they cannot reason about how the environment changes between one time point and 
the next. 

Finally, we examine the work of Battigalli and Bonanno [BB97]. They consider a logic of 
knowledge, belief, and time, and attempt to capture properties of "minimal change" of beliefs. 
Their language is slightly different from ours. Instead of introducing a temporal modality, 
they define a different belief and knowledge modality for each time step: B*(p reads "the 
agent believes (p at time f . Battigalli and Bonanno also assume that propositions are static 
and do not change in time. Thus, the only changes are in terms of the agent's knowledge 
and belief. Battigalli and Bonanno propose an axiom system similar to the axioms of Kraus 
and Lchmann (that is, they use K5 for knowledge is K5, KD45 for belief, and take axioms 
KBl and KB2 of Section 2.7 to characterize the connection between knowledge and belief) 
that also includes two additional axioms that can be written in our language as 

BTl. BiOBi(P ^ B4 
BT2. Bi(P BiOBicP 

Battigalli and Bonanno claim that these axioms capture the principle that the agent does 
not change her mind unless new knowledge forces her to do so. Intuitively, this principle 
also applies to conditioning, and thus it is instructive to understand when these axioms are 
satisfied in our framework. 
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It turns out that RANK combined with a minimal assumption imphes both BTl and BT2. 
We say that a system has finite branching if it allows only finitely many "branches" at each 
local state of an agent (that is there are only finitely many observations that an agent can 
make at each point). 

Lemma 28 Let X be a synchronous static system satisfying PRIOR, RANK, SDP, and 
perfect recall that has finite branching. Then (X, r, m) \= Bi4> BiQBi4> for all propositional 
formulas (p. 

PROOF. See Appendix A.4. □ 

Are these conditions necessary to characterize BTl and BT2? The answer is no. First, the 
proof of Lemma 28 applies to systems with infinite branching, if the agents' prior satisfies 
an infinitary version of A2. As shown in [FHK96], this infinitary version is satisfied by 
K-rankings and preference orderings that are well founded (that is, they have no infinite 
descending sequences ••• -< -< W2 -< Wi). Thus, any system with static propositions 
whose prior is induced by a well-founded preference order satisfies BTl and BT2. Note that 
BTl and BT2 do not characterize RANK, since they put restrictions only on certain events 
(ones definable by a conjunction of a formula and the agent's new knowledge at some time 
point). However, RANK is the most natural restriction that implies these axioms. 

Thus, we see that Battigalli and Bonanno essentially require systems with minimal change 
to satisfy conditioning with a prior that is a ranking. As we shall see in the next section, 
similar requirements are made by the AGM formulation of belief revision [AGM85] . 

4-2 Properties of Prior Plausibilities 

If we take the plausibilities in a system to be generated by a prior, then many of the conditions 
we are interested in, such as QUAL and REF, can be viewed as being as being induced 
by the analogous property on the prior. We have considered these properties only in the 
context of Kripke structures for knowledge and probability, so to make sense of the prior 
having the "analogous property", we have to be able to view the set of runs as a Kripke 
structure for knowledge and probability. Let X be a synchronous system satisfying perfect 
recall and PRIOR. Define Mj = {TZ, ir^, IC{, . . . , /C^, V^, . . . , V^), where is an arbitrary 
truth assignment, IC^ is the full relation, i.e., TZ xTZ, and VI {r) = V(r,i), the prior of agent i 
at run r. 

Proposition 29 LetX be a synchronous system satisfying perfect recall and PRIOR. If Mj 
satisfies QUAL, REF, SDP, UNIF or RANK, then so does I. 

PROOF. Straightforward; left to the reader. □ 
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Thus, by constructing priors that satisfy various properties, we can ensure that the resulting 
system also satisfies them. In particular. Proposition 29 implies that if 'P(r,j) is independent 
of r, so that agent i's prior is independent of the run he is in, then X satisfies SDR A 
somewhat weaker assumption — that the set of runs can be partitioned into disjoint subsets 
TZi, . . . ,TZk such that for r,r' e TZj, we have V(r,i) — ^(r',i) = (^i)Plj) — ensures that I 
satisfies UNIF. Intuitively, the sets TZj correspond to different settings of parameters. Once 
we set the parameters, then we fix the plausibility measure (and it is the same at all runs 
that have the same setting of the parameters) . 

We conclude this section by examining whether assuming conditioning limits the expres- 
siveness of our belief change operation. A well-known result of Diaconis and Zabell [DZ82] 
that shows that, in a precise sense, any form of coherent probabilistic belief change can be 
described by conditioning. In particular, they show that, given two probability distributions 
Pr and Pr' on a finite space W that are coherent in the sense that Pr{A) = implies that 
Pr'(A) = 0, there is a space W* of the form W x X, a, subset E of W*, and a distribution 
Pr" on W* such that, for all A C W, wc have Ft" {A x X) = Pr(A) (so that Pr" can be 
viewed as an extension of Pr) and Fr'{A) — Fr"{A x X\E). 

We can prove a result in a somewhat similar spirit in our framework. The first step is to 
define a plausibilistic analogue of coherence in systems. 

Let X be a synchronous system. We say that X is coherent if the following condition is 
satisfied for all r and m: Suppose i? C 7^, A™ C W(^r,m,i), 7^(A'") = Rnn{W(^r,m,i)), A'^+'^ C 

W^r,m+l,^), and 7^(A-+l) =Rn n{W^r,m+l,^)). H Pl(.',,n',) (^'") = ^, then Pl(,,^'+1.) (^"'+') = 

±. Despite the different formulation, this condition is analogous to the probabilistic coherence 
of Diaconis and Zabell. Roughly speaking, if a set of runs has plausibility _L (which is 
analogous to probability for Diaconis and Zabell) at time m, then it is required to have 
plausibility _L at time m + 1. More precisely, coherence of a system ensures that sets of runs 
that were considered implausible at (r, m), either by being outside W(^r,m,i) or by being given 
plausibility are also considered implausible at (r, m + 1). Note, this condition does 

not put any constraints on how the runs that are considered possible are ordered. It is easy 
to verify that the following axiom is valid in coherent systems: 

COH. NiOcj) ^ ON,<i> 

Proposition 30 If X is a synchronous and coherent system, then COH is valid in X. 
PROOF. Straightforward; left to the reader. □ 



There is a sense in which the converse to Proposition 30 holds as well: Given a synchronous 
system that is not coherent, we can define a truth assignment tt in this system for which 
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COH does not hold. 



It is easy to see that coherence is a necessary condition for satisfying PRIOR. 

Proposition 31 If X is a synchronous system satisfying perfect recall and PRIOR, then X 
is coherent. 

PROOF. Straightforward; left to the reader. □ 

Thus, PRIOR forces systems to be coherent, and hence to satisfy COH. It also forces systems 
to satisfy CONS, and hence C5. As we shall see, it also forces some other semantic properties. 
Nevertheless, we can show that for coherent systems that satisfy CONS, PRIOR does not 
force any additional properties, by proving an analogue to the Diaconis and Zabell result in 
our framework. 

We say that a formula e CJ^^'^ is temporally linear if temporal modalities in do not 
appear in the scope of the A^j or — >j modalities. Thus, for example, a formula such as 
(0 ip) =^ QBiip is temporally linear, while Ki{Q(f) — O'^') ^ QBiip is not. Temporal 
linearity ensures that all the temporal connectives in are evaluated with respect to a single 
run. The following result says that, at least for temporally linear formulas, we can view belief 
change in a coherent system X as coming from conditioning on a prior, in the sense that we 
can embed X into a larger system where this is the case. 

Theorem 32 Let A be a subset of {Q UAL, NORM, REF, RANK] and let X be a coherent 
synchronous system satisfying perfect recall, CONS, and A. Then there is a synchronous 
system X' satisfying perfect recall, PRIOR, and A, and a mapping f : TZ^ TZ' such that for 
all temporally linear formulas e C^'~^^ , we have {X, r,m) |= if and only if {X' , f{r) , m) |= 



PROOF. See Appendix A.5. □ 



Notice that formulas that just compare an agent's beliefs (or knowledge) at successive time 
points are temporally hnear. All the AGM postulates and the KM postulates (when trans- 
lated to our language) are of this form. Not surprisingly, as we show in [Pri97,FH97a], these 
postulates can be captured by systems with the appropriate prior plausibility. 

14 remark that COH is analogous to the axiom KiQcf) ^ QKicj) that characterizes perfect recall 
in synchronous systems [FHMV95]. Roughly speaking, this is because coherence ensures that the 
agent does not forget what she ruled out as implausible. 

We note that this result is, in a sense, stronger than Diaconis and Zabell's. They examine only 
the probability of events, which are essentially prepositional formulas (i.e., formulas without modal 
operators). 
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Can we extend Theorem 32 to the full language? We conjecture that Theorem 32 actually 
holds for all G not just temporally linear formulas. This conjecture implies that a 

formula is valid with respect to synchronous systems satisfying perfect recall, CONS, and 
PRIOR if and only if it is vahd with respect to synchronous coherent systems satisfying 
CONS and perfect recall. That is, except for COH and C9, we do not get any new properties 
by assuming PRIOR and CONS. 

Note that the construction described by Theorem 32 does not necessarily preserve SDP or 
UNIF in the transformation from X to X' . This is due to the fact that in the presence of SDP 
or UNIF, PRIOR forces new semantic properties. Recall that UNIF implies that there is a 
partition of possible points such that two points (r, m) and (r', m') are in the same cell if and 
only if Vi{r,m) = Vi{r',m'). Let PERSIST be the requirement that this partition changes 
minimally in time. More precisely, we say that a system satisfies PERSIST if for all runs 
r,r' eTZ and m such that (r, m + 1) ~i (r', m+ 1), we have that Vi{r, m + 1) — Vi{r' , m + 1) if 
and only if Vi{r. ni) = Vi{r', m). Intuitively, PERSIST (in the presence of synchrony, perfect 
recall, and CONS) implies that the partition of points at time m + 1 is determined by the 
partition of corresponding points at time m and the knowledge relation at time m + 1. 

Proposition 33 IfX is a synchronous system that satisfies perfect recall and either PRIOR 
and UNIF, or SDP, then X satisfies PERSIST. 

PROOF. Straightforward; left to the reader. □ 

It is not clear to us at this stage whether PERSIST forces new properties in our language. 
However, if we assume that PERSIST holds, we can get a result analogous to Theorem 32. 

Theorem 34 Let A be a subset of {QUAL, NORM, REF, SDP, UNIF, RANK} and let X 
be a coherent synchronous system satisfying perfect recall, CONS, PERSIST, and A. Then 
there is a synchronous system X' satisfying perfect recall, PRIOR, and A, and a mapping 
f :TZ^ TZ' such that for all temporally linear formulas e JC^'-^^, {X, r,m) |= if and only 
if{X',f{r),m)^<t>. 

PROOF. See Appendix A.5. □ 

Thus, the question of whether PRIOR forces new properties in the presence of UNIF re- 
duces to the question of whether PERSIST forces new properties. Finally, since SDP implies 
PERSIST, PRIOR does not force new properties in the presence of SDP. 

Our discussion of conditioning and priors up to now assumed synchrony and perfect recall. 
Can we make sense of conditioning when we relax these assumptions? Note that the definition 
of PRIOR does not rely on perfect recall. PRIOR is well defined even in systems where 
agents can forget. However, in such systems, the intuitions that motivated the use of PRIOR 
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arc no longer valid. In particular, PRIOR does not imply coherence and the analogue to 
Proposition 22 does not hold: we no longer can construct Vi{r,m + 1) from Viir.m) since 
runs that are considered impossible at time m might be considered possible at time m+ 1. 
Dropping the assumption of synchrony also leads to problems, even in the presence of perfect 
recall. In an asynchronous setting, an agent might consider several points on the same run 
possible. The question then arises as to how (or whether) we should distribute the plausibility 
of a run over these points. Two approaches are considered in a probabilistic setting in [PR97], 
in the context of analyzing games with imperfect recall. It would be of interest to see to what 
extent these approaches can be carried over to the plausibihstic setting. 



5 Conclusion 

We have proposed a framework for belief dynamics that combines knowledge, time, and 
plausibility (and hence beliefs), and investigated a number of properties of the framework, 
such as complete axiomatizations for various sublanguages and various properties of the 
relationships between the modal operators. Of course, the obvious question is why we should 
consider this framework at all. 

There are two features that distinguish our approach from others. The first is that we use 
plausibility to model uncertainty, rather than other approaches that have been mentioned in 
the literature, such as preference orderings on worlds or e-semantics. The second is that we 
include knowledge and time, as well as belief, explicitly in the framework. 

We could have easily modified the framework to use other ways of modeling uncertainty. 
Indeed, in a preliminary version of this paper [FH94c], we used preference orderings. We have 
chosen to use plausibility measures for several reasons. First, plausibility measures generalize 
all approaches to representing uncertainty that we are aware of. The use of plausibility makes 
it easier to compare our approach, not only to preference-based approaches (e.g., [Bou92]), 
but also to approaches based on K-rankings (e.g., [GP92]), probably measures (e.g., [HT93]), 
or any other measure of uncertainty. More importantly, it makes it easier for us to incorporate 
intuitions from other approaches. We have already seen one example of this phenomenon 
in the present paper: we defined a plausibihstic analogue of conditioning, and used it to 
model minimal change. As we show in [FH97a], we can represent the standard approaches to 
minimal change — belief revision and belief update — in terms of conditioning. Moreover, the 
semantic characterization of conditioning should allow us to apply it more easily to deal with 
complications that arise when the language lets us reason about multiple agents, actions, 
and beliefs about beliefs. Another example of adopting probabilistic intuitions is given in 
[Pri97,FH95,FH96b], where plausibihstic analogues of independence and Markov chains are 
described and used to define a novel approach to behef change. We beheve that these notions 
will have applications elsewhere as well. Finally, plausibility measures have the advantage of 

We could, of course, redefine PRIOR so as to guarantee that Proposition 22 holds, but this leads 
to other complications. 
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greater expressive power than other approaches. For example, work on defaults has mainly 
focused on properties of structures with a finite number of worlds. In our framework, however, 
even a simple system with two global states might have an uncountable number of runs. 
As shown in [FHK96], once we examine structures with infinitely many worlds, qualitative 
plausibility measures can capture natural ordering of events that cannot be captured by 
preference orderings, possibility measures, or K-rankings. 

As we have tried to argue throughout the paper, the explicit representation of knowledge and 
time makes it much easier to study belief dynamics. Most current work in the area examines 
only the beliefs of an agent and how they change after incorporating a new belief. Many 
simplifying assumptions are made: that there is a single agent, that the agent's knowledge 
does not change, that new information can be characterized in the language, and so on. 
It is useful to study this simple setting in order to get at the basic issues of belief change. 
However, these simplifying assumptions are not suitable when we want examine belief change 
in more realistic settings (such as the diagnosis example of Section 3.2). This means that 
most of the results in the current belief change literature are not directly applicable in many 
standard AI problems. Our framework dispenses with most of the simplifying assumptions 
made in the literature, and thus can be viewed as a first step towards providing a model of 
more reahstic settings of belief change. 

We have focused here on the foundations of the framework. In the future, we hope to apply 
the framework to examine more realistic problems. We have already begun to do this. For 
example, in [FH94c] we provide a detailed analysis of iterated prisoner dilemma games be- 
tween two agents. It is well-known that the players cannot cooperate when they have common 
knowledge of rationality. However, we show that they can cooperate when they have com- 
mon belief of rationality. A recent proposal by van der Meyden [Mey94] for multi-agent belief 
change can easily be embedded in our framework [van94]. We hope to use our framework to 
study some of the problems considered by van der Meyden, such as speech-act semantics. 
Another natural application area is reasoning about actions and planning in the presence of 
uncertainty. We believe that the flexibility and expressive power of the framework will help 
to clarify what is going on in all these areas. 
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A Proofs 



A.l Proofs for Section 2.7 

Theorem 7: K (resp., K45, KD45) is a sound and complete axiomatization for with 
respect to M (resp., A^cons^ _y^coNS,NORM^ 



PROOF. As usual, soundness is straightforward, so we focus on completeness. We prove 
completeness by showing that for M G M.k (resp. TW^) J^'k*) there is a structure G M. 
(resp. M^ONS^ _y^coNS,NORM) g^^j^ ^Yia.i for aU G , we have (M,w) ^ (p ii and only if 
(M+jf/;) ^ 0. Completeness then follows from Theorem 1. 

Let M = (W, vr, . . . , be a Kripke structure for belief. We construct a Kripke struc- 
ture for knowledge and plausibility M"*" = {W,t:, ICi, . . . , ICn,Vi, . . . ,Vn) as follows. We 
set }Ci{w) to be the set of worlds where agent i's behefs are the same as in w. Formally, 
{w, v) G /Cj if Bi{w) — Bi{v). It is easy to verify that /Cj is an equivalence relation. We define 

Viiw) = (Vr(«,,i), Pl(ui,i))j where W^w,i) = I3i{w) is the set of worlds agent i considers possible, 
Pl(^ j)(0) = 0, and Pl(^ j)(a4) is 1 if A C j) is not empty It is easy to verify that these 
(trivial) plausibility measures are qualitative. 

We now prove that {M,w) |= if and only (M'^,w) |= (j) for any (f) G . This is shown 
by induction on the structure of 0. The only interesting case is if (f) is of the form Bi(f)'. 
Assume {M,w) \= Bicj)' . We want to show that {M^ ,w) \= Ki{true 0'). We start by 
noting that {w, v) G JCi if and only if Bi{v) = Bi{w). This implies that Vi{v) = Vi{w). Thus, 
(M+,i;) 1= true — >i 0' if and only if (M+,w) |= true — >i (j)'. Thus, it suffices to show that 
{M~^,w) ^ true — >i 0', since this implies that {M'^,w) |= Ki(true -^i 0'), i.e., (M+,u') ^ 
Bi(j)'. There are two cases. If Bi{w) = 0, then W(_w,i) = 0- This implies that true (p' 
holds vacuously. If Bi{w) is not empty, then using the induction hypothesis we conclude that 
= Bi{w). From the definition of Pl(^^j) we conclude that Pl(^^i)(|0'](^^j)) = 1 and that 
Pl(«;,i)(h0l = 0. Thus, (M+,w) ^ true -^i 0' and hence (M+,w) \= Ki{true -^i 0')- 
Now assume {M,w) |= -^Bicf)' . Then there is some v G Bi{;w) such that (M, v) |= -i0'. 
Using the induction hypothesis we conclude that Pl(ui,i)(|~'0'](u),i)) = 1- Hence, {M^,w) |= 
->{true -^i (j)') and therefore, (M"'",w) |= -'Ki^true —>-i 4>'). 

It remains to show that if M G M^^ then M+ satisfies CONS, and if M G Al^*, then M+ 
also satisfies NORM. Assume Bi is transitive and Euclidean. Let w and v be worlds such 
that {w,v) G Bi- We claim that Bi{w) = Bi{v). If {w,t) G then since Bi is Euclidean we 
get that {v,t) G ^Bj. If {v,t) G then since Bi is transitive we get that {w,t) G Sj. Thus, 
Bi{v) = Bi{w), as desired. Recall that if Bi{v) — Bi{w), then our construction ensures that 
V G K,i{w). Hence, Bi{w) C ]Ci{w) and M+ satisfies CONS. Assume that Bi is serial. This 
implies that for all w, Bi{w) is not empty. Thus, our construction guarantees that is 
not empty and ^\w,i){^{w,i)) >-!-■ ^ 
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Theorem 8: ^X^^ (resp., ^x™'^"^^ ^;^kb,cons,norm^ ^ ^^^^^ complete axiom- 
atization of C^^ with respect to M (resp., M^^^^, ^jCONs.norm^^ 



PROOF. Again soundness is straightforward, so we focus on completeness. We sketch a 
completeness proof following the usual Makinson [Mak66] style of proof. We describe only 
the parts that are different from the standard proofs. See, for example, Halpern and Moses 
[HM92] for details. 

In order to prove completeness, we need only show that if the formula (p is consistent with the 
axiom system (i.e., AX™, AX^^'^ons p^^KB,com,mM^ ^^^^ ^ satisfiable in a Kripke 

structure of the appropriate class (i.e., M, Al*-"^^^, or _;Vl*-'°^^'^°^'^, respectively). 

Let y be a set of formulas and AX an axiom system. We say that V is AX-consistent if for 

all 01, . . . 0„ e V, it is not the case that AX I i(0i A ... A The set F is a maximal 

consistent set if it is consistent, and for each formula 0, either (f) e V or -xf) e V . 

We now build a canonical model for AX^^, in which every AX^^-consistent formula is 
satisfiable. M^^ has a world Wy corresponding to every maximal AX^^-consistent set V of 
formulas; we show that (M^^, wy) |= if and only ii (f) eV. 

Wc proceed as follows. If is a set of formulas, define V/Ki = {0 : K^cj) e V} and V/Bi = 
{(t> : B,(f> e V}. Let = {W, tt, /Ci, . . . , JC^, P^, • • • , Pn), where 

• W = {wv : V is a maximal AX^^- consistent set of formulas} 

• 7i{wy)[p) — true if and only if p e 
. IC, = {{ivv,Wu):V/KiCU} 

• Vi{wv) = (W^(^v/0'Pl(«'v,o)' w^®^® = i'^u ■ V/Bi C U}, Pl(^^,i)(0) = 0, and 
PW,i)(^) = lforyl^0. 

Using standard arguments, it is easy to show that the /Cj's are equivalence relations (see 
[HM92]). Using a standard induction argument, we can verify that {M^^^wy) H ^ 
only ii (j) & V. 

This construction proves completeness for AX^^. To prove completeness for the other two 

variants we Tise the same construction, setting W to correspond to the maximal AX™'*"^'^^- 
consistent sets (resp. AX^^''-'^^^'^°^^^-consistent sets). We must show that the resulting 
canonical models satisfy CONS and NORM, respectively. 

Let M^^'CONS be the canonical model constructed for AX^^'°°^^. To show that M^^'^^^^ 
satisfies CONS, it is enough to show that V/Ki C V/Bi. To show this, assume G V/Ki. 
Then Kicj) e V. Since KB2 e AX^'^^^^ we conclude that e V, and thus e V/B^. 

Let M^B'CONS,NORM ^j^g canonical model constructed for AX^^'^°^^'^o^^. The argu- 
ment above shows that m^^'^o^s.norm satisfies CONS. To show that it satisfies NORM, 
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i.e., P\w,i){W(w,i)) >-L, it is enough to show that V/Bi is consistent, for then there must 
be some U such that V/Bi G U. Assume, by way of contradiction, that V/Bi is incon- 
sistent. Then there are formulas 0i, . . . , 0^ ^ V/Bi such that h -<{4>i A ... A (pm)- Since 
01, . . . , 0n ^ ^/-Bj, we conclude that S^^i, . . . , -Bj^m ^ ^- Using the K45 axioms for 
standard arguments show that Si(0i, . . . , 0„) e V, and hence that Bi{false) e y, which 
contradicts the consistency oiV. □ 

Lemma 10: Let M be a propositional Kripke structure of knowledge and plausibility satis- 
fying CONS and SDP. Suppose that w, i, and a are such that the most plausible worlds in 
Vi{w) are exactly those worlds in ]Ci{w) that satisfy a, i.e., MP{Vi{w)) — {w' e }Ci{w) : 
{M,w') 1= a}. Then for any formula (p G C^^ that includes only the modalities Ki and Bi, 
{M,w) \= (j) if and only if {M,w) \= 0*, where 0* is the result of recursively replacing each 
subformula of the form Biip in by Ki{a =^ 

PROOF. We prove by induction that for any w' G /Cj(w), {M,w') |= if and only if 
{M,w') \= 0*. The only interesting case is if has the from -Bj0'. Suppose that (M, u/) |= 
Bi(f)'. This implies that (M, w') |= true -^i 0', i.e., for all w" G MP(Pj(w')) we have 
(M,w") 1= 0'. Now let w" G ICi{w'). If (M,w") |= -a, then (M,w") ^ a ^ (0')*. If 
(M, w") 1= a then, by definition, w" G MP{Vi{w)), and since we assumed SDP, MP{Vi{w')) = 
MP{Vi{w)). Thus, we conclude that {M,w") \= 0', and using the induction hypothesis we 
get that {M,w") \= (0')*- We conclude that all worlds in /Cj(w') satisfy a =^ (0')*) ^^'^ thus 
{M,w') \= Ki{a ^ (0')*). Now assume that (M,w') |= Ki{a (0')*). Let w" be any world 
in JCiiw'). Since we assumed SDP, we have that MP{Vi{w")) = MP {Vi{w)) is the set of 
worlds in lCi{w) that satisfy a. We conclude, using our induction hypothesis, that all worlds 
in MP{Vi{w")) satisfy 0'. Hence, (M, w") ^ true 0'. Since this is true for all w" G }Ci{w') 
we conclude that (M, w') |= Bicf)'. □ 

A. 2 Proofs for Section 2.8 

Theorem 11: AX is a sound and complete axiomatization for JC^^ with respect to M.. 

PROOF. Again, we just describe the completeness proof. This proof draws on the usual 
completeness proofs for S5 modal logic, and the completeness proof for conditional logic 
described in [Fri97,FH97b]. 

We proceed as follows. If y is a set of formulas, define V/Ki = {0 : KiCp G V} and V/Ni = 
{0 : Ni4> G V}. We define a canonical model M'^ = {W, tt, /Ci, . . . , /C„, Vi, . . . , Vn) as follows: 

m W — {wv : V is a maximal AX-consistent set of formulas} 

• T^{wv){p) — true if and only if p G F 

• lCi^{{wv,wu):V/KiQU} 
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• Vi{wv) = where 

• = {^u : V/N, C U}, 

■ ^(wv,i) = {[4>\(wv,i) '■ e C^'^} where [(t)\(wv,i) = {^u e : G t/}, and 

• Pl{w,i) is such that Pl(«,v,i)([0](w,i)) ^ Pl(w,i)([V'](w,i)) if and only if (^VV') -^i ij) eV. 

We need to verify that M"^ is indeed a structure in M.. Using standard arguments it is easy to 
show that the /Cj relations are equivalence relations. In [Pri97,FH97b] we prove that Vi{wv) 
is a well-defined qualitative plausibility space. 

Finally, we have to show that (M"^, wy) H ii^ a^<i only \i (f) & V. As usual, this is done by 
induction on the structure of 0. We use the standard argument for formulas of the form Ki(f) 
and arguments from [Fri97,FH97b] for formulas of the from -^i -0. We omit the details 
here. □ 

Theorem 12: Let A he a subset of {RANK, NORM, REF, UNIF, CONS, SDP} and let A 
be the corresponding subset of {C5, C6, C7, C8, C9, CIO}. Then AX\J A is a sound and 
complete axiomatization with respect to the structures in M. satisfying A. 

PROOF. Yet again, we focus on completeness. We obtain completeness in each case by 
modifying the proof of Theorem 11. Wc construct a canonical model as in that proof, checking 
consistency with the extended axiom system. The resulting structure is in M. and has the 
property that (M, wy) \= (j) and only ii (p & V . We just need to show that this structure 
also satisfies the corresponding semantic restrictions. 

First, we consider CONS and axiom C9. Assume that C9 is included as an axiom. It is 
easy to see that this implies that V/Ni C V/Ki. This implies that Q K,i{wv) in our 

construction. 

Now consider the relationship between SDP and CIO. Assume that CIO is included as an 
axiom. We need to show that if wu € K,i{'Wv), then Vi{wu) = Vi{wv). It is enough to show 
that (j) il^ & V ii and only if -^i ip & U, since these statements determine Vi in our 
construction. Assume (p tp E V. Then, according to CIO, Ki{(() ip) e V , and thus 
(f) '4> E V/Ki. Recall that wu e K,i{wv) only if V/Ki C U. We conclude that — >i ip E U. 
The other direction follows from the fact that /Cj is symmetric in our construction, and thus 
wv e lCi{wu). 

The desired relationship between RANK, NORM, REF, and UNIF and the axioms C5, 
C6, C7, and C8 is proved in [Fri97,FH97b], for a logic that does not mention knowledge. 
Since these conditions put restrictions on Vi{w) and do not involve knowledge, the proof of 
[Fri97,FH97b] goes through unchanged; we do not repeat it here. □ 

Theorem 13: Let A be a subset of {CONS, NORM, REF, SDP, UNIF, RANK}. The formula 
(f) is satisfiable in a Kripke structure satisfying A if and only if it is satisfiable in a Kripke 
structure with at most 2\^^^'''^^\ worlds. 
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PROOF. The proof of this theorem rehes on techniques from [FH96a]. We sketch only the 
main steps here. The proof is based on a standard filtration argument. 

Suppose there is a structure M and a world w in M such that (M, w) |= cf). Let Sub'^{4>) — 

Sub{(f)) U {-10 : G Sub{(f))}. We say that V C Sub'^{(f)) is an atom if for each e Sub{(f)), 

either (f) & V or -i0 G V. We say that a world -u; in M satisfies an atom V if for all G 

we have (M, w) \= (j). It is easy to see that each world satisfies exactly one atom. Given 

a world w\ we define [w] to be the equivalence class containing all worlds that satisfy the 

same atom as w. For each equivalence class [w], we arbitrarily choose a representative world 

G H- We define M' = {W ,n' , }C[, . . . }C[^,V[, . . . ,Vl,). where W = {[w] : w E W}, 

7r'(H) = 7r{w[^]), = {(M, M) ■■ (^^V^/) G /C,}, and ^'(N) = (W^fn,)' P1(M.))' ^^ere 

W^(M.) = {[^'] : ^' e and P1'(h.)(^) < P1(M.)(^) ^WM"^* ^ ^-(-n-^)) ^ 

Pl(^(^j,i)(5* n where A* = {w" : 3[w'] G G [w']}. Arguments essentially 

identical to those of [FH96a] show that (M', [w]) \= ijj if and only if {M,w) \= ijj for all 

■0 G Sub{(f)); we omit details here. 

We now have to describe how to modify this argument to ensure that M' satisfies A. The 
modifications for NORM, REF, UNIF and RANK are described in [FH96a]. Suppose that M 
satisfies CONS. Let [w'] G By definition, w' G But since M satisfies CONS, 

we have that w' G ICi{w[y,]). By definition, we get that [w'] G /C-(['u;]). We conclude that M' 
satisfies CONS. Finally, suppose that M satisfies SDP. We force M' to satisfy SDP as follows. 
For all worlds w, we choose a representative world 'Wac,([w)]) G /C'j(['u;]) such that if {w, w') G Ki, 
then W]Ci{[w\) = wiCi{\w'])- We then modify the construction so that, for each world v G }Ci{w), 
we have ■Pj'(['y]) = 'Pliwidiiw]))- It is easy to see that for all ■0 — X e Sub{4>), we have that 
{M,w) 1= -0 — >i X if aiid only if {M,W]Ci([w])) \= "0 X- Thus, it is easy to show that 
after this modification we still have that {M', [w]) |= -0 if and only if (M, w) |= -0 for all 
G Sub{(j)). □ 

Theorem 15: Let A be a subset of {CONS, NORM, REF, SDP, UNIF, RANK} containing 
CONS and either SDP or UNIF. If talks about the knowledge and plausibility of only one 
agent, then is satisfiable in a Kripke structure satisfying A if and only if it is satisfiable 
in a preferential Kripke structure satisfying A with at most |Sub(0)|^ worlds. 

PROOF. Assume M — (W,7r,JCi,V-i) is a structure satisfying 0. Since CONS is in A, we 
must have that C /Ci(w)). Without loss of generality, we can assume that /Ci consists 

of one equivalence class, that is, that JCi = W x W. Since CONS and SDP imply UNIF, and 
since A contains CONS and either SDP or UNIF, we conclude that M satisfies UNIF. Using 
techniques from [FH96a] we can assume, without loss of generality, that for each world w, 
the plausibility space Vi{w) is preferential (i.e., induced by some preference ordering) and 
that has at most \Sub{(f))f worlds. 

Choose Wo E W such that (M, wq) |= 0. For each formula ^Kiip G Sub{(f)) such that 
{M,wo) 1= -'Klip, we select a world such that {M,w^) |= -i^^. Let T be {wq} U 
{w^ : -iKitp G Sub{(j))}. Note that the cardinality of T is at most \Sub{(l))\. Define M' — 
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{W^n^K'ijV'i) by taking W to be the union of VF^'^^^) for each w e T, taking n' to be tt 
restricted to W, and taking V'i{w) — Vi{w). Clearly \ W'\ is at most \Sub{(f))f. A straightfor- 
ward argument for all subformulas i/j of (f) and all worlds w' G W, we have (M, w') \= ip if and 
only if {M',w') \= ip. It follows that {M',wq) \= (p, so (p is satisfiable in a small preferential 
structure. □ 

Theorem 16: Let A be a subset of {CONS, NORM, REF, SDP, UNIF, RANK}. If CONS e 

A, but it is not the case that UNIF or SDP is in A, then the validity problem with respect 
to structures satisfying A is complete for exponential time. Otherwise, the validity problem 
is complete for polynomial space. 

PROOF. The proof combines ideas from [FH94a,FH96a,HM92]. We briefly sketch the main 
ideas here, referring the reader to the other papers for details. 

The polynomial space lower bound follows from the polynomial space lower bound for logics 
of knowledge alone [HM92] . For the exponential lower bound we use exactly the lower bound 
described Fagin and Halpcrn [FH94a] for the combination of knowledge and probability 
(which is in turn based on the lower bound for PDL [FL79]). This lower bound construction 
uses only formulas involving Ki and probabilistic statements of the form Wi{4>) = 1 (i.e., the 
probability of (p is 1). Since Ni(p has exactly the same properties as Wi{(p) — 1, the same 
construction applies to our logic. 

In the cases where we claim a polynomial space upper bound, this is shown by proving 
that if a formula (p is satisfiable at all, it is satisfiable in a structure that looks like a tree, 
with polynomial branching and depth no greater than the depth of nesting of /Cj and -^i 
operators in (p. The result now follows along similar lines to corresponding results for logics 
of knowledge. 

Finally, the exponential time upper bound follows by showing that if a formulas is satisfiable 
at all, it is satisfiable in an exponential size structure that can be constructed in deterministic 
exponential time; the technique is similar to that used to show that logics of knowledge with 
common knowledge are decidable in deterministic exponential time [HM92] or that PDL is 
decidable in deterministic exponential time [Pra79]. □ 

Theorem 17: Let A be a subset of {CONS, NORM, REF, SDP, UNIF, RANK} containing 
CONS and either UNIF or SDP. For the case of one agent, the validity problem in structures 
satisfying A is co-NP-complete. 



PROOF. We show that the satisfiability problem is NP-complete. It follows that the validity 
problem is co-NP-complete. The lower bound is immediate, since clearly the logic is at least 
as hard as propositional logic. For the upper bound, by Theorem 15, (p is satisfiable in a 
structure satisfying A if and only if (p is satisfiable in a structure M of size polynomial in 
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|0|. We simply guess a structure M and check that is satisfiable. It is easy to show that 
model checking can be done in polynomial time (see [HM92,FH96a]). □ 

A . 3 Proofs for Section 3. 3 

Theorem 20: The axiom system AX^ is a sound and complete axiomatization of C^^'^ 
with respect to C. 

PROOF. As usual, we focus on completeness. Again, we construct a canonical interpreted 
system X such that if e £KCt -g consistent, then is satisfied in X. The outhne of the 
proof is similar to that of Theorem 11. 

We proceed as follows. Let be a maximal AX^-consistent set of formulas in C^^'^ . We 
define V/Q = {0 : Qcf) G V}. We claim that V/Q is also a maximal AX^-consistent set. 
To show that V/Q is maximal, assume that (p ^ V/Q. Then Qcj) ^ V. Prom axiom T2, 
we have that Q^(l) G V, and thus, -xp G V/Q. This shows that V/Q is maximal. To show 
that V/Q is AX"^- consistent, assume that there arc formulas ^ V/Q such that 

h^xT ^(01 A . . . A From Kl, Tl and RTl we get that false G V/Q. Thus, Qfalse G V. 
Using T2 we get that -iQtrue G V. Using RTl, however, we get that Qtrue G V, which 
contradicts the assumption that V is consistent. Thus, V/Q is AX^-consistent. Finally, we 
define V/Q"^ to the result of m applications of /Q. Repeated applications of the above 
argument show that V/Q"^ is a maximal AX^-consistent set for all m > 0. 

We construct a canonical interpreted system as follows. Let X — (TZ, tt, Pi, . . . , Vn), where 

is a maximal AX^-consistent set} such that 
. rX{m) = V/Q"\ and 

• rYim) = {V/Q^)/K,, 

• Tiij-^ ,m){p) = true if and only if p G r^(m), and 

• Vi{r^,m) = {W^rV,m,i):'PkrV,m,i)): where 

• = {(r^,n) : iV/Q^)/N, C U/Q^ }, and 

• Pl(r^,m,j) is such that Pl(ry,m,i)([(l>](ry,m,i)) < Pl(r-^,m,j)(['0](rV,m,i)) ^nd Only if ((pV ijj) 

i/j G V/Q"', where = {{r^,k) G W^rV,m,i) ■ <t> e C^/O'}- 

Using the arguments in the completeness proof for conditional logic of [Fri97,FH97b], we 
can show that Vi{r, m) is well-defined for all i. Finally, we have to show that {X, r^ ,m) \^ (f) 
if and only if </) G r^(m). As usual, this is done by induction on the structure of 0. This 
is identical to the proof in of Theorem 11 except for the Q modality, which is handled by 
standard arguments. We omit the details here. □ 

Theorem 21: Let A he a subset of {RANK, NORM, REF, UNIF, CONS, SDP} and let A 
he the corresponding subset of {C5, C6, CI, C8, C9, CIO}. Then AX^ \J A is a sound and 
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complete axiomatization with respect to systems in C satisfying A. 

PROOF. Again, we focus on completeness. We obtain completeness in each case by modi- 
fying the proof of Theorem 20. We construct a canonical system as in that proof, checking 

consistency with the extended axiom system. The resulting system has the property that 
(X, r^,m) 1= (/) if and only if ^ G V/Q"^. We just need to show that this system satisfies 
the corresponding semantic restrictions. The desired relationship between these semantic 
properties and axioms is proved in [Fri97,FH97b] and the proof of Theorem 12. □ 

A. 4 Proofs for Section 4-i 

Proposition 25: Let 1 he a synchronous system satisfying perfect recall and PRIOR. If (j) 
characterizes agent i's knowledge at {r,m + 1) with respect to his knowledge at {r,m), then 
(X, r,m + l) \= ip ^ if and only if (X, r, m) |= O(0 A ^) -^i QC- 

PROOF. Expanding the definition we get that 'R-{lO{4>Ai^)}{r,m)) = {r' G W^r-i) : (r', m) ~i 
(r, m), (r',m + l) |= (pAip}. Similarly, we get that ??.([■?/'] = {r' G W(^r,i) '■ (r',m+l) ~i 
{r,m + l), {r',m + l) \= ip}. However, since 4> characterizes agent i's knowledge at time m + 1 
with respect to his knowledge at time m, we get that (r', m + 1) ~j (r, m + 1) if and only if 
(r', m) ~i (r, m) and (r, m + 1) ^ 0. We conclude that 7^(|O(0 A V')l(r,m)) = 7^(M(r,m+i))- 
The lemma now follows directly from Proposition 22. □ 

Lemma 28: Let X be a synchronous static system satisfying PRIOR, RANK, SDP, and 
perfect recall that has finite branching. Then (X, r, m) \= Bi(p = BiQBi(j) for all propositional 
formulas 0. 

PROOF. For all points (r, m) in X, note that W(^r,m,i) = U{A^}, where A^ is the set of points 
{r',m) ~j (r, m) such that the agent's new knowledge at time m + 1 is If X has finite 
branching, this is a finite partition of W(^r,m,i)- Additionally, note that if Pl(r,m,i) is a ranking, 
and Ci, . . . , Cfe is a finite partition of C, then since Pl(^r,m,i)iC) — niaxi<j<fe P\(^r,m,i)iCj), there 
must be some j such that P\r,m,i){Cj) = P\(r,m,i)iC). In particular, for all C C W(^r,m,i), either 

P\r,m,i){C) = T or P\r,m,i)(W{r,m,i) - C) = T . 

For the "=^" part, suppose that {X,r,m) |= Bicj). If P\{r,m,i)iW{r,m,i)) — -L, then {X,r,m) |= 

BiOBiCj) vacuously If Pl(r,m,j)(W^(r,m,i)) 7^ -L, then Pl(r,m,i)(M(r,m,j)) > Pl(r,m,i)([-'0l(r,m,i))- 

Assume that ip is such that P\(^r;m,i){A^) = T. It is easy to verify that since Pl(r-,m,i) is a rank- 
ing, we get that Pl(^r,m,i){Arp fl I0](r,m,i)) > Pl(r,m,o (^V- ^ (r,m,i) ) • Let r' be a run such that 
(r',m) G A^. By SDP, we get that P\r,m,i) = Pl(r',m,i), and thus Pl^r',m,i){A^ n I0](r',m,i)) > 
P\^r',m,i)iA^ n |-'0](r',m,i))- By definition of A^, we have that {r",m + 1) ~i {r',m + 1) if 
and only if [r" ,m) G A^. Since X satisfies PRIOR, P\{r' ,m+i,i) is the result of conditioning 
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Pl(r,m,i) on A^. Moreover, since propositions are static, we get that Pl(r',m+i,j)([0](r',m+i,i)) > 
Pl(r',m+i,i)([-'0l(r',m+i,i))- Thus, ( J, r', m) \= OB,(l). We conclude that C lOBi(j)]^r,m,i), 
and thus Pl(r,m,i)(|O-Sj0](r,m,j)) = T. Morcovcr, since A^ C [O-^i^l (r,m.,j) for all A^ such that 

Pl(r,m,i)(^v) = T, we get that F\r,m,i){hOBi(l)](r,m,i)) < max{F\r,m,i){A^) ■ Pl(r,m,i)(^v) < 

T} < T. We conclude that P\r,m,i){lOBi(f)l(r,m,i)) > Pl(r-,m,i)([-'O-Bi0l(r,m,j)), and thus, 
(X,r,m) ^BiOB4. 

For the part, suppose that (X, r, m) |= BiQBi(j). If Pl(r,m,i)(W^(r,m.,i)) = -L, then (X, r, m) |= 

vacuously. If Pl(r,m,i){W(r,m,i)) 7^ -L, then F\r,m,i){lOBi(p](r,m,i)) > 

Pl(r,m,i)([-'O-Bj0l(r,m,i))- ThuS, sluCC Pl(r.,m,0 IS & ranking, Pl(r,m,i)( 10^201 (r,m,j)) = T. Let 

(r', m) be some point in A^ for some ip. By SDP, we have that (X, r', m) |= OB(f) if and only 
if {X,r",m) 1= 0^0 for all points (r",m) G A^. Thus, [O5i0l(r,m,i) = ^Vi U ... U A,p^ 
for some Since Pl(r,rrM) (lO^i^l (r,m,i)) > Pl(r,m,i)(I-'O^i0l(w)), we get that 

Pl(r,m,i)(^v) ~ ~'~ °^^y if = '/i'j for some 1 < j < k. Moreover, since ^4^^, . . . , ^4^^ is a finite 
partition of lOA^l (r,m,i)) there must be at least one 1 < j < k such that P\(^r,m,i){^tpj) = T. 
Let i/jj be such that Pl(^r,m,i){Aipj) = T. Suppose that {r\m) G A^^. . Then we have that 
Pl(r',m+i,j)([0l(r',m+i,j)) > Pl{r',m+i,i) ( h0l (r',m+i,i) ) • Since X is syuchrouous, static, and sat- 
isfies perfect recall, PRIOR, and SDP, we get that P\(^r,m,i){.A.^j H |0](r,m,i)) > Pl(r,m,i) (A^j H 
I^0](r,m,i))- Since Pl(,.,m,i) is a ranking, we get that P\r^rn,i){A^j n I0](r,m,i)) = T, and thus, 
Pl(r,m,j)([0l(r,m,i)) = T. Finally, if Pl(^,^,i)(A^) < T, t\ieYiP\r,m,i){A^^l-^4>\{r,m,i)) < T. Thus, 

since Pl(r,m,i)(h0l{'',m,O) = ^a^V- Pl(r,m,i)(^V ^ H^l {r,m,i) ) , We get that Pl(r,m,i)([~'0l(r-,m,i)) < 

T. We conclude that (X, r, m) |= Bicj). □ 
Proofs for Section 4-2 

Theorem 32: Let A he a subset of {QUAL, NORM, REF, RANK} and let I be a coherent 
synchronous system satisfying perfect recall, CONS, and A. Then there is a synchronous 
system X' satisfying perfect recall, PRIOR, and A, and a mapping f : TZ TZ' such that for 
all temporally linear formulas 4> G C^'-''^, we have (X, r, m) \= 4> if and only if (X', f{r),m) ^ 

PROOF. To construct X', we use a general technique for taking a "sum" of a sequence 
of plausibility spaces. Let A be an ordinal and let {Si : < i < A} be a sequence of 
plausibility spaces, where Si = {Wi, Plj) and the Wj's are pairwise disjoint. Define (BiSi as 
{UiWi,Pl^s,), where Pl^sA^) > P^es^B) if either P1,(A n Wi) = P1,(S DWi) ^ ± for 
all i, or there exists some i such that Pli{A n Wi) > Pli{B fl Wi), P\i{A fl Wi) >±, and 
Plj{A n Wj) = Plj{B n Wj) = ± for all j < i. We can think of ®iSi as a lexicographic 
combination of the Si^s. 

Lemma 35 (a) ®iSi is a plausibility space, 

(b) if Si is qualitative for all i, then ®iSi is qualitative, 

(c) if Si is ranked for alii, then ®iSi is ranked. 
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(d) (®iSi)\c is isomorphic to ®i{Si\c) under the identity mapping. 

(e) {®iSi)\wj is isomorphic to Sj under the identity mapping. 

(f) IfWi, . . . , Wk — 0; then is isomorphic to ®i>k+iSi. 

PROOF. We have to show that < is reflexive, transitive, and satisfies Al. It is easy to see 
that, by definition, < is rcfiexive. Next, we consider transitivity. Suppose that Pl05.(A) > 
PW,(5) and P\(BsAB) > PW,(C). If Pl.(5nW^,) = U for all then clearly Pl(CnI^-) = U 
for aU i (since Pl®5,(5) > P1®5.(C)), so Pl®5,(^) > P1®5,(C). So suppose that F\{BnWi) > 
±i for some i. Let i and j be the smallest indexes such that Pli{A fl Wj) > ±i and Plj(-B n 
Wj) > J-j. It is easy to see that i < j, and that Pljfc(C fl Wk) — -Lfc for all A; < j'. If i < j, we 
conclude that FhiAnWi) > F\i{CnWi) = ±i, and thus Ple5,(^) > Ple5,(C). On the other 
hand, if i = j, then by definition F\i{A n Wi) > Pb(5 n Wi), and F\i{B n Wi) > Fk{C n IV'i). 
Since < is transitive in Si, we get that Fli{A fl Wi) > Pli(C fl Wi). Thus, we conclude 
that Fl^SiiA) > Pl®s.(C), as desired. Finally, we consider Al. Suppose that A C B. Then 
An Wj C Sn for all i. Since each Si satisfies Al, we have that Plj(An Wj) < Plj(Cn Wj) 
for aU i. It easily follows that Ple5.(A) < Ple5.(S). 

Suppose that Si is qualitative for all i. We have to show that (BiSi is also qualitative. We 
start by considering A2. Suppose that A, B, and C are pairwise disjoint sets such that 
Pl(BSi{A UB) > Fl^sXC) and Pies, (A U C) > Pl®5,(5). Let i and j be the minimal indexes 
such that Fli{{A U B) n Wi) > ±i and F\j{{A U C) n Wj) > ±j. We claim that i = j. 
Assume, by way of contradiction, that i < j. Then, Plj((A U C) fl Wi) = -Li and hence 
Fli{A n Wi) = ±i. Moreover, since PleSi(A U C) > Ple5i(5), we get that F\i{B n Wi) = ±i. 
Using A3 in Si, we conclude that Pli{{A U B)r\ Wi) = _Lj, which contradicts our assumption 
that Pli((A U B) r\ Wi) > -Li. Symmetric arguments show that wc also cannot have j < i. 
Thus, i = j. By definition F\i{{AlJB)nWi) > F\i{CnWi) and F\i{{AuC)nWi) > F\i{BnWi). 
Using A2 we conclude that F\i{A fl Wi) > Pli((-B U C) fl Wi). It is also easy to verify, using 
A3, that F\j{{B U C) n Wj) = ±j for all j < i. Thus, we get that Pl©Si(A) > PhsA^ U C), 
as desired. Next, consider A3. The construction of ®Si is such that Pl^SiiA) —-L if and only 
if Pli{A n Wi) —-L for all i It is easy to see that A3 follows from A3 in each Si. 

Finally, part (c) follows immediately from the definition, part (d) follows immediately from 
COND, part (e) is a special case of part (d), and part (f) follows immediately from the 
definition. □ 

Returning to the proof of Theorem 32, first suppose that REF is not in A. Let I — 
{TZ,7r,Vi, . . . iVji) be a coherent synchronous system satisfying perfect recall and CONS. 
Roughly speaking, the proof goes as follows. We construct a system X' which consists of 
countably many copies of TZ. The runs in TZ"^, the mth copy of TZ, are used to simulate the 
agent's plausibility assessment at time m. More precisely, for all times m, we define a prior 
on TZ^ that corresponds to the agent's plausibility measure at time m in I. These priors 
are then combined using ® to construct the agent's prior in I'. Since © orders the priors 
lexicographically, if m < m', the priors on TZ"^ dominate those on TZ"^' . The construction 
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guarantees that at time m, the agent considers possible only runs in TZ"^ U TZ'^'^^ U . . .. Since 
the prior on 7^™ dominates the rest, the agent's plausibility measure at time m is similar 
to that at time m in X. This similarity is what guarantees that conditional formulas are 
evaluated in the same way in I and I'. This "peeling away" of copies of TZ ensures that all 
temporally linear formulas holding in runs in I are also satisfied in the corresponding runs 
inr. 

The formal construction proceeds as follows. Let i? C 7^ and / G IV* (recall that IN* — 
IN U {cxd}). Define i?' = {r' : r e R}, where, for each i e {e, 1 . . . , n}, we have 

{ri{m),m) ii I > m 
{ri{l),'m) ii I < m. 

Let X' = (7l',n',V[, . . . ,Vn), where TZ' = U^g^v*'^', ^i' is defined so that if m < / then 
7r'(r',m) = 7r(r, m) and if m > / then 7r(r',m) = 7r(r, /), and VI is defined by the priors 
described below. 

To define a prior on TZ', we first define a plausibility space VJ^^^ on TZ^ for each m G IN, run 
r E TZ, and agent i. We want the time m projection of "P^j) to be isomorphic to T'i{r,m). 
To achieve this, we define = (7^^_^^, Pl^_,)), where 7^^,) = TZ{W^r,m,^)T and Pl^_^) is 

defined so that for A C W^r,m,i), we have Pl(^^i)((7^(A))") = V\r,m,i){A). For I e IN*, we 
define the prior of agent i at run to be the combination of these priors for all time points: 

It is easy to see that X' is synchronous. It is also easy to check that X' satisfies perfect recall: 
From the definition, we have that 

{(r"', m) : (r', m) G /Ci(r, m), Z' > m} if Z > m 
{{r'\m) : {r' ,1) e K:i{r,l)} if / < m. 

Moreover, since X satisfies perfect recall, we have that TZ{ICi{r,m + 1)) C TZ{lCi{r,m)). We 
conclude that TZ' {K,[{r'' ,m + 1)) C TZ'{K,'^{r'' ,m)), which is just what we need for perfect 
recall. 

Let (j) G (so that (j) does not include any temporal modalities) and / > m. We show 

that {X' ,r\m) |= if and only if {I,r,m) \= 0. As usual we prove this by induction on the 
structure of 4>. The only interesting cases are these that directly involve modalities. 

We start with the Ki modality. Suppose that (X, r, m) \= KiCp. Then for all points (s, m) G 
/Cj(r, m), we have (X, s, m) \= 0. Let {s'^, m) G K,'i{r\ m). From the definition of X' we get that 
(s, m) G Ki{r,m) and k > m. Using the induction hypothesis, wc get that {X',s^,m) |= 0. 
We conclude that (X', r', m) ^ i^^i0. Now suppose that (X, r, m) ^ ^^^^0. Then there is a point 
(s, m) G /Cj(r, m) such that (X, s, m) |= -i0. Using the induction hypothesis we conclude that 
(X, s"*,m) 1= -10. Since (s"*,m) G /C^(r',m), we conclude that (X',r',m) ^ irj0. 



r^(m) = < 



X:;(r\m) = 
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We now turn to the — modality. The definition of PRIOR imphes that V[{r\m) is the 
projection of "P^^.; conditioned on TZ' {lC[{r\ m)) . Now V'^^^i --^ = ©mPl™,j). Parts (d) and 
(f) of Lemma 35 imply that P(V!_i)k'(K;^(r',m)) is isomorphic to ®k>mi'P^rd))\n'{mri,m)))- Con- 
sider the first term in the "sum", P^j) |7^'(K;'(r',m))- Since X satisfies CONS, we have that 
W(r,m,i) ^ }(^i{r,m). Thus, conditioning on IZ' {K[{ir\ m)) does not remove any runs from 
^TrA = (^(^(nm.i))""- It follows that V'^i)\n'm{r'',m)) = P(T,i) which is isomorphic to Vi{r, m) 
under the mapping r'"* ^ {r\m). Finally, since P^j) is the first plausibility space in the 
"sum", it determines the ordering of all pairs of sets, unless both of them are assigned plau- 
sibility ± by Pl(" j). Putting all this together, we conclude that if A'^B' C W'^^i^--^ and 
A,B C W(^r,m,i) such that (7^(A))'" = n'{A') n TZ"^ and {n{B))'^ = n'{B') n 7^'", and if 
P1(,,™,,)(A) > ±, then P1'(,,_„,,)(A') > Pl'(,,,„^,)(5') if and only if Pl(.,^,i)(A) > Pl(,,„,,)(5). 

Assume that (X, r, m) |= -^i ip. Thus, either Pl(r,m,j)([0]{r,m,i)) = -L or Pl(r,m,j)(l0 A 
i>\{r,m,i)) > Pl{r,m,j) (10 A (,,„,,)). If Pl(r,m,j) ( M (r,m,i) ) = -L, then from the coherence of X it 
follows that if A C W(^r,i',i) and TZ{A) C 7^([0](r,m,i))) then Pl(r^;/^j)(74) = ±. This implies that 
Pl['^ j)((7^([0](r^m^j))'' n 'R-{W(r,i',i)y') = -L for all I' > m. Since /C-(r',m) contains only points 
from TZ^' for T > m, we get that Pl(ri,m,i)(M(r',m,i)) = -L- Thus, we conclude that (X', r\ m) |= 
in this case. Now suppose that Pl(r,m,i)(|0 A ip}{r,m,i)) > Pl(r,m,i)([0 A -^ipj{r,m,i)) ■ If 

we could show that (7^(|0](r,m,i)))™ = '^'(I0](r'.m,i)) ^ TZ^, and similarly for -0, then we 
could apply the argument of the previous paragraph to show that Pl(r!.m.i)(I</' A 'ip\{rKm,i)) > 
PI{r',m,i)(I^A-i'0](r',m.,i))- This, in tum, would allow us to conclude that (X', r', m) |= — >i -0. 
The'fact that {Tz({4>\r,m,i))T = ^'(M(r',m,i)) n 7^"* follows from the following chain of 
equivalences: 



e {nm{r,m,i))r 

iff (S,m) e |0](r,^,i) 

iff (s, m) e W(r,m,i) and (X, s, m) |= 

iff G in{W^r,m,i))r = T^Tr,i) iuductiou hypothesis) (X', s™, m) ^ 

iff (s™, m) G and (X', s™, m) h 

iff (s"^,m) e |0|(^i,^,i) 

iff s-e7^(|0l(,. n7^-. 

Thus, in either case, we conclude that (X',r',m) |= V', as desired. 

For the converse, suppose that (X, r, m) ^ — V'- Then Pl(T-,m,i)(|0](r,m,i)) > -L and 
Pl(r,m,i)(l0 A ij\{r,m,i)) 1^ Pl(r,m,i)([0 A By the samc arguments as above, we get 

that ^\'iri, m,i)il<l> ^'iliri, m,i)) > ^ and Pl(^i^^^i)(|0 A Vl(r',m,i)) ^ Pl(r',m,i) ( [0 A ^^1 ,m,i) ) " 

Thus, {X\r\m) ^ -^i ip, as desired. 

Finally, for r E TZ, define /(r) = r°°. We have proved that if G then {X,r,m) |= 

if and only if {I' , f{r),'m) |= 0. Since this holds for all m, a straightforward argument 
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by induction on structure shows that this holds, not just for formulas in but for all 

temporally linear formulas. 

We now have to ensure that X' satisfies A. Suppose that X satisfies QUAL. Thus, Vi{r,m) 
is qualitative for all agents i, runs r & R, and times m. Using part (b) of Lemma 35, we 
conclude that the prior P^,. j) is qualitative for all agents i and runs r & R. This implies, 
using Proposition 29, that X' satisfies QUAL. Similarly, if X satisfies RANK, using part (c) 
of Lemma 35 and Proposition 29, we get that X' satisfies RANK. 

Suppose that X satisfies NORM. Then Pl(r,TO,i)(proe| > ± for all agents i, runs r E TZ, and 
times m. This implies that -'{true -^i false) is valid in X. Suppose that / > m. Then since 
-^{true — >j false) G C^*" , we conclude from the proof above that {X\r\m) \= -i{true — >j 
false). Thus, P\'(^j.i ^ni-^dtrueli^rKm.i)) > -L- Suppose that / < m. By definition, we have that 
IZ' {lC[{r-\m)) = (7^(/Ci(r, /)))'. Using part (e) of Lemma 35, we get that P(V,j)|-R,'(jc'(r',m)) 
isomorphic to P'r^j)- However, the latter plausibility space is isomorphic to Vi{r,l). Thus, it 
satisfies T > ±. We conclude that X' satisfies NORM, as desired. 

Up to now we have assumed that REF is not in A. If REF is in A, then REF does not hold for 
A, although it does hold at many points. To understand the issue, suppose that REF holds 
in X. Since X' satisfies PRIOR, to show that REF holds in X', according to Proposition 29 
it suffices to show that all priors satisfy REF. This is indeed the case if Z 7^ oo. For suppose 
that r' e A C n'. We want to show that P\ri,i){^) > ^- Recall that P^'^, .) = ©mP(T,i)- From 
the definition of ©, it easily follows that if Pl(,,,i)(^ n TZ^) > _L, then Pl(,.i ^^(A) > _L. By 
definition, we have that F\[,^.i ^^{A n TZ^) = F\(r.i.i.)(A'), where A' = {{s,l) : s' G A}. Clearly 
(r, /) G A', since {r\m) G A. Since X satisfies REF, we must have that Pl(r,/,j)(A') > ±. It 
follows that Pl(ri,i) satisfies REF ii I ^ 00. This argument breaks down if / = 00. Indeed, it 
is clear that P^'^oo j) does not satisfy REF. Since 7?.°° is disjoint from TZ^ for m < 00, and we 
only "sum" P^-^ for m < 00 to obtain V'^^oo j), it follows that 7?.°° is disjoint from j), so 
REF does not hold. 

Fortunately, a slight modification of the construction of X' can be used to deal with the case 

REF G A. Define V^^^) = Pr(^,,))' ^^^^^ ^(?,^) = {^°°) Pl(^,i)({^~}) > ^- Modify 

the construction of X' so that the prior of agent i in run r' is V'^^i = V'l^^i © V^i (Thus, 
V"^i = ©m<oo'Pp i)-) It is easy to check that X' now does satisfy REF. The argument in the 
case that / 7^ 00 remains unchanged. On the other hand, if G A C 7^', it is immediate 
that n 7^°^) > ±, so we can now deal with this case as well. If QUAL, RANK, or 

NORM is in A, it is easy to see (using the same argument as above) that X' also satisfies 
QUAL, RANK, or NORM. 

It remains to show that this modification of the prior does not affect the evaluation of 
formulas. That is, we must show that (X, r, m) |= if and only if {X',r^,m) \= (p for all 
I > m. Again, we proceed by induction on the structure of formulas. The argument for 
formulas of the form Kicf) goes through unchanged, since the changes to PI' did not affect 
the fCi relations. The argument for formulas of the form (f) — >j ip goes through with almost 
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no change. The only case that requires attention is if {I,r,m) \= i/j and [0](r,m„i) — -L- 
Our earher arguments showed that Pl'^ j-)((7^(|0](,.,„ j))'' fl 7^(W(r,i',i)))'') = -L for all /' > m, 
/' 7^ oo. These arguments go through without change. We must now show that this also holds 
if /' = oo. But, from the definition of Pl~, we get that P1^,^)((7^(I0](^,„^,^))°° n 7^°°) = ± 
unless r°° e 7?.([0](r,m,i))°°- This imphes that (r, m) G [(ji*] (r,m,i) • But this cannot happen, 
since Pl(r,m,i)([0l(r,m,«)) = -L and I satisfies REF. □ 



Theorem 34: Let A be a subset of {QUAL, NORM, REF, SDP, UNIF, RANK} and let I 
be a coherent synchronous system satisfying perfect recall, CONS, PERSIST, and A. Then 
there is a synchronous system X' satisfying perfect recall, PRIOR, and A, and a mapping 
f : TZ H' such that for all temporally linear formulas (f) e C^^^ , (X, r, m) [=0 if and only 
if{T,f{r),m)^4>- 



PROOF. Suppose that X = {TZ,n,Vi, . . . ,Vn) is a coherent synchronous system satisfy- 
ing perfect recall, CONS, PERSIST, and A. If neither CONS nor UNIF are in A, then 
Theorem 32 guarantees that there is a system X' that satisfies the stated properties. 

Suppose that UNIF e A, but SDP, REF ^ A. (We sketch the modifications required to 
deal with SDP and REF below.) It does not follow that the system X' constructed in the 
proof satisfies UNIF. To see why, suppose r, r' and m> k are such that (r', k) G Wi^r,k,i) but 
(r, m) {r',m). UNIF implies that Vi{r,k) = Vi{r',k) and (since X also satisfies CONS) 
that W(^r,m,i)^W{r' ,m,i) = 0- Heucc, our construction guarantees that V'^^k j) 7^ V^^ik although 
j-'k g W'f^^k j)- Thus, the prior in X' does not satisfy UNIF. It follows that X' does not satisfy 
UNIF either, for P|(r^ k) ^ P;(r'^ k), ahhough (r'^ k) G W[^k^k,iy 

The solution to this problem is relatively straightforward. We modify our construction so 
that the prior does indeed satisfy UNIF. In particular, we modify the prior V' to ensure that 
if Vi{r,k) = Vi{r',k), then = V[ 

r"',ky course, we have to do so carefully, so as to 
make sure that nothing goes wrong with the rest of the argument in Theorem 32. 

We start with a modification of the construction of © that takes sets (rather than sequences) 
of plausibility spaces and returns a new plausibility space. 

Lemma 36 Let S be a set of plausibility spaces such that the sets {W : {W, PI) G S} are 
pairwise disjoint. Then there is a plausibility space ®S such that 

(a) if S = {W, PI) G S, then <S)S\w is isomorphic to S under the identity mapping, 

(b) if S is qualitative for all S E S, then <^S is qualitative, 

(c) if S is ranked for all S & S, then <S>S is ranked. 
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PROOF. Without loss of generality there is an ordinal A and a sequence {Si : < i < \} 
such that Si G S for all i, and for all S & S, exists an i such that S = Si.^'^ Define 
(8)5 = (BiSi- Part (a) of Lemma 35 guarantees that (E)S is a plausibility space. Parts (a), (b), 
and (c) follow immediately from parts (e), (b), and (c) of Lemma 35, respectively. □ 

Recall that to satisfy UNIF and PRIOR, it suffices to find a partition of R such that all 
the runs in each cell have the same prior. We now examine a possible way of partitioning 
the runs in the system. Let r & R. Define [r, m]i = {(r',m) : {r',m) ~j {r,m),Vi{r' ,m) = 
Vi{r, m)}. Thus, [r, m]i is the set of points in which agent i has the same knowledge state and 
plausibility assessment as at {r,m). (Note that if W(^r,m,i) 0) then since I satisfies CONS, 
Vi{r' ,m) — Vi{r^rn) implies that [r' ^m) (r, m).) 

Lemma 37faj For all times m, the collection {TZ{[r,m]i) : r e TZ} is a partition ofTZ. 

(b) For all times m and runs r, VF(r,m,i) ^ 

(c) For all times m and runs r, 7^([r, m + 1]^) C TZ{[r, m\i). 

(d) For all times m and runs r,r' such that (r', 0) e [r,0]i, if {r',m) ~i {r,m), then {r',m) e 
[r, m]i. 

PROOF. By definition, if {r',m) e [r, m]i, then [r',m] = [r, mjj. Thus, if [r, m]i ^ [r',m]i, 
then [r, m]j fl [r',m].j = 0. Part (a) follows immediately. For part (b), suppose that (r'.m) G 
W(^r,m,i)- Since X satisfies CONS, we have that {r',m) {r,m). Moreover, since X satisfies 
UNIF, we have that Vi{r', m) = Vi{r, m). Thus, (r', m) G [r, m]j. We conclude that W(^r,m,i) ^ 
[r, m]j, as desired. For part (c), suppose that (r',m +1) G [r, m + 1]^. This implies that 
(r',m+l) ~j (r,m + l) and Pi(r', m + 1) = 'Pi{r,m + 1). Since X satisfies perfect recall, we get 
that (r', m) ~i (r, m). Moreover, since X satisfies PERSIST, we get that Vi{r', m) = Vi{r, m). 
We conclude that {r',m) G [r, m]j. Thus, TZ{[r,m + C TZ([r,m]i), as desired. Finally, we 
prove part (d) by induction on m. When m = 0, part (d) obviously holds. Suppose that 
m > 0, (r', 0) G [r, 0]j, and (r',m) ~j (r, m). Since X satisfies perfect recall, we have that 
(r', m — 1) ~j (r, m — 1). Using the induction hypothesis, we get that (r', m — 1) G [r, m — 1]. 
This implies that Vi{r', m — 1) = Vi{r,m — 1). Using PERSIST, we conclude that Vi{r\ m) — 
Vi{r,m). Thus, {r',m) G [r, m]i, as desired. □ 

Using both © and ®, we now construct a prior over TZ' that satisfies UNIF. For r E R, let 

[r]i abbreviate 7^([r,0],). Define Pf^j^ = : r' G [r]^}, where = (7^^^^), Pl^_,)) 

is the prior defined in the proof of Theorem 32 that is isomorphic to ViXr.m) under the 
mapping r'"^ {r',m). We must show that V^^^ is well defined; that is, we must show that 
if Vp^i) ^ 'P"r",iY then 7^^, is disjoint from '7^^;„ Note that if (r',m) G [r",m]i, then 
and PP'^j) are identical. Using part (b) of Lemma 37 we get that if (r',m) ^ [r",m]i. 

If <S is uncountable, this construction may require the axiom of choice. There is a variant of the 
construction that does not require the axiom of choice, but the additional complexities involved do 
not seem worth the trouble. 
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then "^(^/^i) n7?.(^„ = 0, as desired. Thus, Vjp^. is indeed well defined. We now define V'^^^i = 
®mVJp^. as the prior of agent i in run rK 

We claim that this family of priors satisfies UNIF. Notice that W^^^i .-^ = UmyeirjiT^J^' {)■ If 
j-'m g then, by definition, r' e W(^r,m,i)- Using parts (a) and (b) of Lemma 37, we get 

that r' e [r]i. It easily follows that [r']i — [r]i, so indeed the construction guarantees that 
^(V' i) ~ ^(r"",i)' ^ desired. Since the family of priors satisfies UNIF, so does X'. 

Let (f) G C^^ and / > m. As in the proof of Theorem 32, we now proceed by induction on 
the structure of formulas to show that (X', r\ m) \= (p if and only if (X, r, m) \= (j). The only 
difference arises in dealing with the — >i modality. 

As before, parts (d) and (f) of Lemma 35 imply that "P^,.; ,j)|7^'(K:'(r^m)) is isomorphic to 
®k>m{^[r]}n'(K'.(ri,ni)))- Again, wc cousider the first term in the "sum", P[^j7j/(ic'{r',m))- We 
want to show that V^^.\n'{mrKm)) = P(J^,i)k'(x;j(r',m))- RecaU that 7^(™^)|7^'(^^(r^m)) is the first 
term in the analogous "sum" in the proof of T?heorem 32. Thus, even though we are using 
a different prior from that of the proof of Theorem 32, after conditioning, they are essen- 
tially the same. By Lemma 36, we have that 'P™J7^™ = VJ^^y Thus, it suffices to show 

that U^/g[^]^7^[^, .) n n\mr\m)) = 7^^^.) n 7e'(/C-(r', m). The inclusion from right to left is 
immediate. For the opposite inclusion, suppose that G Uf./g[f.]^7^p n7^'(/C^(r', m)). Since 
s'" G 7^'(/C^(r', m)), we must have (r, m) ~j (s,m). Since s™ G Ur/6[r],7?.p there must also 
be some run r' G [r]j such that s G IZ^, -y Since s G 7V^{r-\ i), we have that (s, m) G W(r',m,i)- 
By part (b) of Lemma 37, (s,m) G [r',m]i. By part (c) of Lemma 37, we get that (s, 0) G 
[r',0]i. Since (r',0) G [r,0]i, it immediately follows that [r',0]i = [r,0]i. Hence, (s.O) G [r,0]i. 
Now by part (d) of Lemma 37, we get that (s,m) G [r, m]j. Thus, Vi{s,m) = Vi{r,m). 
Since X satisfies UNIF and (s.ni) G W(^r'.rn.i), it follows that Vi{s,m) = Vi{r',m). Hence, 
(s, m) G W(^r,m,i)- Finally, we can conclude that s G TV^^y as desired. Given this equivalence, 
we can deal with the — >i case just as we did in the proof of Theorem 32. 

Finally, we need to ensure that X' satisfies A. The proof of Theorem 32 shows that if X 
satisfies NORM, then so does X'. Using parts (b) and (c) of Lemma 36, it easily follows that 
if X satisfies QUAL or RANK, then so does X'. 

If REF and UNIF are both in A (but SDP is not), then we need a further modification of 
the prior, in the same spirit of that in the proof of Theorem 32. Define Pj^. = ([r]°°, Plj^J, 
where P1[^^(0) = ± and Pl|^.(74) = T for all %. We now take the prior of the agent to be 
V'l^i = V'f^^i © V^T^. . It is straightforward to show that the resulting system satisfies REF 
and the requirements of the theorem, using essentially the same arguments for dealing with 
REF as in the proof of Theorem 32. 

Finally, suppose SDP G A but REF is not. Note that, since CONS and SDP imply UNIF, 
X satisfies UNIF, so we can assume without loss of generahty that UNIF is also in A. To 
get X' to satisfy SDP, we further modify V' so that it depends only on the agent, and not 
the run. Thus, we define Vf" = : r G 7^}, and define V[^i -^ = ©m^r- Clearly, 
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with this prior, X' satisfies SDP. Again, we need to check that this change in prior does 
not affect the rest of our argument. Once more, the only difficulty comes in dealing with 
the -^i case. Just as in the case of UNIF, we proceed by showing that 7^^™|7^'(A:'(r*,m)) — 
P|^^^|7^/(x;'(ri,m))- The argument is actually even easier than that for UNIF: We show that 
^r'T^Xr'.i) T^'m{r\m)) = 7^^ .) n 7^'(/C;(r^ m). Again, the inclusion from right to left is 
immediate. For the opposite inclusion, suppose that s'^ e U^'T^-^^/ j) n 7?.'(/C-(r', m)). Since 
e 7?.'(/C-(r', m)), we must have (r, m) (s.m). Since G U,.'i?™, j-,, there must also be 
some run r' such that s G TZ^/^iy Thus, (s,m) G W(r',rn,i)- Since X satisfies CONS, we have 
(s, m) ~j (r',m). It foUows that (r',m) ~j (r, m). Since X satisfies SDP, we must have that 
W(r,m,i) = W(r',m,i), SO (s, m) G W(^r,m,i)- Therefore, s G 7^(^,1), as desired. 

The modifications to deal with the case where both SDP and REF are in A are identical to 
the case with UNIF, and are omitted here. □ 
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